I mean they can make a sneaky update to the client that introduces such changes.

Sure, if you won't update your client, this won't affect you, but would potentially open you up to other security vulnerabilities.