Then the attacker could just block the update servers.