The service wouldn't give the browser elevated privileges. If you're worried about an update being compromised, then don't, since they're delivered over SSL and

The service wouldn't give the browser elevated privileges. If you're worried about an update being compromised, then don't, since they're delivered over SSL and (I believe) are also signed separately.