More likely just a man in the middle attack. Apt typically uses HTTP (no TLS) as the signatures give the security. But in this case it sounds like the vulnerability is that after a successful signature check the legit file can be overridden by the attacker through some HTTP shenanigans.