Are the updates signed? Who is trusted with updating the apps? What is the threat model? These are kind-of essential FAQ security questions.