> I can guarantee you that having that password won't allow you in any way, to deploy persistent malware on developers's machines

I don't think I'll believe such guarantees about a company whose update dissemination server password for a write-privileged account is CompanyName123.

I mean, you could be correct, but still.