APT does not (or did not when I last checked) protect you from replay attacks:

https://bugs.debian.org/863317

Given the amount of time I spent on researching this bug (I tried literally the first thing that came to my mind and it worked), I suspect there's a lot more security bugs in APT lurking.