Probably the obvious fix is for them to change the auto update path to https rather than http on a subsequent update. Are there any good reasons why this wouldn't have been done in the first place?