What about confidentiality of the package downloads though?
e.g. Snoop the traffic, notice they are downloading a fix, they probably don't have it, automatically attack them before they apply it.
I suppose in your case the window would be smaller using HTTPS, as the package downloaded could probably be inferred only after the download is complete. But your method would need automation anyway, so I don't think the difference in timing would really matter in practice.
But if you are in the position to automatically attack someone, why wait to see if they are downloading a fix? Why not just try to attack with known recent vulnerabilities anyway?