There is another attack where the user is updated to a particular version by a MITM. That is distinct from a basic version freezing attack.
The difference is there might still be an attack where:
- User is at version N
- Version N + x is vulnerable
- Version N + x + y is latest
- User terminal asks for N + x + y and the attacker serves N + x
However this attack is much less critical than anything letting an attacker downgrade (only applies against versions updated infrequently).
Regarding VLC on Mac, which uses Sparkle, this issue could be avoided by using HTTPS just for the updates feed (AppCast), which is not mirrored.
It could happen, sure, but that is very far from the "OMG, updates are in HTTP" issue, or even a downgrade attack.