Would it have killed them to give even a little bit of guidance how to securely update the apt package(s)?

If necessary, with instructions for downloading and verifying it out of band

Or maybe by passing a parameter to the old apt that disables the vulnerable HTTP download resumption when downloading the new apt