How do you validate that a thumbdrive sent to you is actually from the vendor? Is that really more secure than a properly encrypted OAT update? Security has lots of blind corners.

Good question. How many hackers send me malware via email? Every day. How many hackers send me a thumb drive? Zero.

The thing is, thumb drives cost money, and mailing things cost money. Mass hack attacks rely on not costing the attacker any money.