Sierra update is 731MB. See https://support.apple.com/kb/DL1956?viewlocale=en_US&locale=...
BTW... not sure why the downloaded file is actually downloaded on _http_
I have personally looked at the accompanying connections and it looks like Apple sends hashes over a proper TLS connection. Updates are also signed as another layer of security.