> But this is still a risk, as the link to the app that does the syncing could be blocked to maintain a vulnerability
If you can mitm the dns or ip you can still do this even with https.
> downgraded to a vulnerable version
does the app allow "upgrading" to a lower version number automatically?
> or potentially compromised
the app enforces signed updates, no?
That said, they really should get https going for the updates.
