That can pretty much happen to any software provider you download software from.
You don't have the time to:
- audit the source code
- check every auto-update hash matches the main hash list "just in case" you get a special update just for you
If you turn off auto-update, you will eventually get hacked because of bitrot