Depending on “security vendors” to do scans of every single update seems naive and over optimistic to me, but hey - everyone’s jumping on the bandwagon regardless of what I think so I guess we’ll see soon.

Don't "security venders" detect and report most of these types of attacks already today?

What's the alternative?