Ideally, you'd want them to use HTTPS to deliver the packages as well. However, I cut free software distribution some slack, because of massive distributed mirroring and delivery by a number of third parties. For Microsoft, it would be easy: why _not_ use HTTPS and get another line of defense?

(update: revelation's comment is insightful; just saw it. I forgot about versioning.)