It's actually not completely outside of my threat profile.

Honestly, with the prevailaince of ransomware attacks, unless you're a literal hermit, it shouldn't be out of anyone's threat profile.

Absolutely. Sufficiently capable LLMs can mass produce exploits against whole ecosystems; recent Anthropic post moves the risk needle from ‘theoretical’ to ‘realized’. Any auto-updating software is running a risk of its cdn and/or build forge being compromised. Scary times.