Nobody's worried about targeted state attacks, they're worried about dragnet state attacks.

...which don't seem to rely on vulnerabilities introduced via update mechanisms.

I don't think we can say that for sure. For one example, there was the Skype update that removed most peer-to-peer features and added interception abilities.

Or, because peer to peer Skype sucked given the dismal status of the average home user's internet connection.