What are the chances a third party could make changes to apps on Google Play that I have installed, so that when I next update I am compromised?
This is a hard question to answer. If law enforcement knew of a vulnerability that would allow them to replace apps in Google Play, they could use it (with varying degrees of legality). Perhaps they could get a court order forcing Google Play to allow them to update other people's apps (but I suspect that Google would fight this as best they could). Law enforcement could even pay the app developer to include specific modifications. There is likely no way of being certain.
But this problem isn't specific to Google Play, Android, or mobile devices. We know that the NSA has intercepted hardware shipments to tamper with the hardware.
If your in the US, it seems unlikely to me that you would be targeted by law enforcement via an attack such as this unless you were suspected of being involved in threats to national security. But that's just a guess. We really can't know. All we know is that nothing has been made public that indicates that law enforcement has done this for non-national security threats.
From the perspective of an attacker who wants to update the app on the Google Play Store without the knowledge of the developer (or bending Google's arm to accept the malicious app, for that matter):
One hurdle is getting victim Android devices to accept the update as an update, instead of as a completely new app.
App upgrade: When the system is installing an update to an app, it compares the certificate(s) in the new version with those in the existing version. The system allows the update if the certificates match. If you sign the new version with a different certificate, you must assign a different package name to the application—in this case, the user installs the new version as a completely new application.
Even if the attacker can upload their malicious .apk to the Google Play Store, they would have to be able to sign it with the developer's private key. Getting a hold of this private key will vary in difficulty from developer to developer, so it's tough to evaluate the chances of this happening.