It's also possible the update manifest contained an url that the updater blindly trusted, and by modifying that file you could change what got downloaded.