It will probably take time to get all of the answers, but in this case, automatic updates are safe.

Although I'm not a Transmission developer, I develop software that uses the same automatic update mechanism. It appears that the hacker did not update the MD5 present in the automatic update mechanism. (Sparkle) Thus, when the automatic update mechanism downloaded the hacked version of Transmission, it reported it as a corrupted download.

You can see the comment here: https://forum.transmissionbt.com/viewtopic.php?f=4&t=17834#p...