An attacker might replace a package with a previous one which has a vulnerability. Downgrade attack. Unclear if the apt client will check if version is the expected one after requesting a package.