Updates are always protected at the OS level which trusts keys on first install and autorejects updates with key mismatches.

The ones vulnerable to attack are first-time installers...