Has this ever been shown to happen in practice? The vendor is the only one who can provide a guarantee that the distribution is genuine (i.e. not tampered with), provide timely updates, security notices, etc.