But then an attacker marks their malicious release as a critical security update. It's really messy unfortunately.