Why would malware bother to hijack the update system like this? It seems like a lot of work to trick the user into installing something that the malware could just install directly.