Desktop updates are signed
The Windows client only downloads an update that carries a recorded signature.
Each published build is hashed and signed before it is offered. An unsigned row is not downloaded.
Check the hash on the Download page after a first install. Later starts check for a newer signed build on their own.