Is Chrome be subject to being used as a malware delivery vector if you could MITM the DNS? Or does its SSL pinning prevent that (presuming that the updates happen over SSL)?
SSL pinning just prevents a rogue trusted CA from MITMing you. SSL certificates specify a domain, no matter what the DNS says.
However, given how many Certificate Authorities have been flaky, compromised, or deferential to certain unsavory authorities, there probably are some actors who could launch both kinds of attacks.
I expect both Google and Microsoft use some private mechanism for authenticating their updates, perhaps SSL but not dependent on any Certificate Authorities or secrets other than those they manage themselves. Pressure from some state authorities, or catastrophic failures in these companies' own security, could give some other malicious actor the power to hijack these updates. But that should be again harder than either DNS subversion or finding/compromising the weakest browser-trusted CA.
(When Google suddenly became so mad at China a while back, my favorite theory -- wholly unsupported by any confirmed info, however -- was that Google had observed China's incursions trying to win control of the various Google auto-update mechanisms. Third-party malware injection via those avenues might threaten Google's very existence, which would justify the strongest possible reaction, in the name of self-preservation.)