> the end user could be MITM'd already with a root certificate maliciously installed on their device
If a malicious root certificate is installed, then the user’s system is already compromised and signature validation won’t help.
If a malicious root certificate is installed, then the user’s system is already compromised and signature validation won’t help.
But also in the other case, not all is lost: Not every malware can (or even tries to) defend itself against any antivirus software in existence. The machine might be compromised, but being able to retrieve the correct upadate for the hypothetically unaffected malware scanner can still give you the signal that your machine is infected and you should reinstall it.