Well, in this case I think it's a remnant of n++ predating any package manager on windows. I do think that an embedded self-updater is better than having to download a new version through the browser.

It wasn't entirely clear to me if the compromise effects those of us who installed it though scoop/winget, as the package manager should pull directly from the correct source, so the compromised updater shouldnt matter. Reinstalled to be sure.