> ...and then all your further installations have to me MITM-ed or you would take notice. Not so trivial for attacker anymore.

Though perhaps more trivial when the attacker has helpfully provided your operating environment.