I was wrong. The updater in 1Password for Windows 1.0.9.333 is vulnerable to an evilgrade attack. It fails to verify the the trust of the certificate on the (alleged) upgrade server and will accept any old self-signed certificated.

I would like to thank whoever sent us a Proof of Concept, and I would like to apologize for actually needing the PoC before sufficiently testing my own claims.