You'll notice
An already-downloaded binary is re-checked against the signed manifest checksum and re-downloaded if it does not match.
Before reusing an already-downloaded native binary, the updater now re-fetches its manifest and compares the binary's sha256 against the manifest's signed checksum, re-downloading it if the checksums don't match. If the manifest can't be authenticated, the checksum comparison is skipped with a warning instead of blocking activation of the retained copy.