I don't agree with Mullenweg on this. He clearly doesn't understand the concept of "defense in depth," that he alludes to in his response. By focusing only on the low-hanging security fruits, you make the biggest one the most appealing target.

To add to that, I find it laughable that Mullenweg suggests the risk is mitigated by web hosts that scan your website for malware. This may be true for a percentage of people who can afford managed WP hosting, but even then, what makes him think that someone sophisticated enough to compromise the WP update servers is going to be sloppy and sling out easily detected malware?