Even just using HTTPS instead of insecure HTTP would prevent this type of attack.

(I see no indication that the attackers obtained forged TLS certificates, and compromising a client-side ISP wouldn’t be enough to get one.)

Yeah but it's wishful thinking to expect all software vendors to do this. What would be better is if operating systems had standard ways to install and update software that was actually well established, so vendors didn't need to roll their own. While Windows has the Microsoft store, not many vendors use it, for various reasons. Most Linux distros have package managers that handle things well enough, and, more importantly, support third party repos.