The update servers are monitored around the clock and since many large webhosting companies automatically scan their customer’s sites for malware, the malicious update would likely be discovered quickly.

As we all know, Yahoo and countless other companies were also "monitoring their servers around the clock". If you face smart hackers, it may take years to notice the hack and then to fix the damage.

It is also real possibility that WP staff could be infiltrated, so you would not deal with man in the middle, but with the man inside. As someone said - the fruit is big, so the stakes are high.