The attacker only needs to compromise the update-infrastructure to be able push a malicious updates to everybody who runs the software [0] [1]

[0] https://blog.malwarebytes.com/android/2021/04/pre-installed-...

[1] https://www.businessinsider.com/asus-acknowledges-computers-...