Sadly, downloading random shady binaries already happens to open source projects whether they charge or not, because the shady people spend effort on SEO and open source developers don't.

For updates, all Windows/Mac software should be self-updating by now. Requiring users to download updates by hand is basically the same as no updates.