This is highly relevant to GrapheneOS and third party application use, but I've chosen the "Off Topic" tag as it really relates to a broader discussion on threat models and application updates — regardless of OS.
Quick background: the native update system for Notepad++ (Windows) was recently compromised by what appears to be state-affiliated (CN/CCP) threat actors.
By utilizing vulnerabilities at the hosting provider, malware was placed on targeted users' machines.
https://notepad-plus-plus.org/news/hijacked-incident-info-update/
Full details, along with IoCs, here: https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/
Quite an extraordinary attack, and there's legitimate debate as to how much blame can be deflected to the hosting provider and how much responsibility the Notepad++ developers bear themselves here.
But the overarching question should really be about the TOFU (Trust On First Use) model itself. Here, users can bear no responsibility as they've done everything right.
Nothing would seem to indicate reasons to worry about the installation, use, and subsequent updates of Notepad++, at reasonable levels of user/admin scrutiny and due diligence. The problem only arrives much later, within ongoing usage of the software.
What should it mean for native application update mechanisms in general? Might the incident highlight and accelerate the need for trusted update stores (Accrescent, Zappstore, etc), along with their development?
How might developers assert their trustworthiness post-Notepad++ incident?
And how should security conscious users act in relation to the TOFU model in their favourite software from now on?
Discussions on Notepad++'s pros and cons, their (in)famous political stances, and other specifics regarding the relevant software itself might be too off-topic for this Off Topic...