Once, I had a problem that somehow someone managed to change files of my website without FTP or SSH credentials. Probably he got in through WP (probably it wasn't a 'he', but an 'it', a bot), we said after investigation.
Anyway, since then I'm using the WordPress File Monitor plugin, which mails me when files are changed. Now, when I update plugins or themes, I first perform a scan with the file monitor, then I update and then I scan again. The monitor gives an alert because of the update, and I remove it, because 'it's because of the update'.
Now I'm wondering, if WP is especially vulnerable when updating (for example, if it would be possible that the update doesn't come from the WP servers but from a hacker), then with this I open a leak in the security of my site.
On the other hand, if the updated plugins / themes work (which I always check), and it's only the files of the plugins that are changed (which I also always check), then it's -in my opinion- not so likely that someone hacked my site during the update.
Am I doing the correct thing here, or should I check better after updating?