> we would have to assume the vendor's update server was compromised

You say "compromised". I say "monetised".

:sigh: