Considering what we now know about tailored access operations, I find it hard to imagine they've not used these abilities to subvert the auto-update functionality of virtually every product there is out there.
Ie. client requests auto-update from front-end server, update is switched and replaced before hitting the front-end server & being delivered.