But if APT is compromized, then the game is over, any malware can reside on your PC. And you cannot trust any hash from that PC, since there exist malwares that could modify it. This is the biggest type of risk there is, when the updater itself could be compromized.

I'm half tempted to downvote this post, but I'll hold off because I'm going to assume you're just acting out of concern and not trying to clickbait.

Hurt the messenger....? I just try to help people, because many people here have hundreds of thousands of dollars worth of assets on their computer. Steem private keys, bitcoin private keys, most people are heavily exposed to risk.

Yeah 99% of the time things will be fine, but if that 1% of the time somebody loses like 500,000$ because nobody warned him. Who's fault will that be?

Better stay prepared for all threats.