A lot of popular applications use customer downloaders rather than allow the user to download the installation binary directly from Adobe, or whoever the OEM might be. For example, here is the Flash installer doing its work:
The security risk here is obvious: if the download is conducted in plain text it is vulnerable to a man in the middle attack. A hacker who controls any router between me and Adobe, including control of my cable modem, can target and intercept this update and supply their own modified binary.
If I use a web HTTPS download from Adobe then I can still be compromised by a MIM attack, but in this case I can know that there is poison because the false certificate my browser is given by the MIM will not match Adobe's HTTPS certificate.
However, when I use the custom Adobe Flash Player Installer (as above) I have no way to know what certificates are being exchanged. For all I know, the binary is being transferred in plain text, which is highly insecure obviously.
Is this installer to be trusted?