Switching the updater to make use of https as an alternative to recent plaintext http could well be great and easy starting point. It's good reward if it also checks new exe's signature, but in initial location, it must not allow anyone on the way to intercept requests so effortlessly.