Security and usability are at odds. Large organizations (thus far) tend to favor usability. It's a cost-benefit analysis, and the benefit of not redeveloping their web apps outweighs the cost of increasing security.
It's annoying at first, but it works pretty damned well.
It's true that after the attackers got the entry point, there are several thing wrong according to article (ie. "Four days after the e-mails arrived, administrators spotted suspicious traffic leaving a server." -- so they got a mail that used an IE vulnerability, and then a server got affected?).
However, given how many Certificate Authorities have been flaky, compromised, or deferential to certain unsavory authorities, there probably are some actors who could launch both kinds of attacks.
I expect both Google and Microsoft use some private mechanism for authenticating their updates, perhaps SSL but not dependent on any Certificate Authorities or secrets other than those they manage themselves. Pressure from some state authorities, or catastrophic failures in these companies' own security, could give some other malicious actor the power to hijack these updates. But that should be again harder than either DNS subversion or finding/compromising the weakest browser-trusted CA.
(When Google suddenly became so mad at China a while back, my favorite theory -- wholly unsupported by any confirmed info, however -- was that Google had observed China's incursions trying to win control of the various Google auto-update mechanisms. Third-party malware injection via those avenues might threaten Google's very existence, which would justify the strongest possible reaction, in the name of self-preservation.)
SSL pinning just prevents a rogue trusted CA from MITMing you. SSL certificates specify a domain, no matter what the DNS says.