Yes, and they do. Which is why people should rely on the gpg keys of vendors as well as watching forums and other buyers to work out if things have suddenly become suspicious.