My Android phone is now giving me notification of an updated version of Garmin Connect and I am feeling reluctant to install. Does anyone know, is there any way to verify that the changes are safe ? (Changelog, audit, integrity check) does Google Play verify an update in a case like this? I don't know how this works

In a scenario where Garmin is completely compromised, is it unthinkable that the attacker could also distribute malicious updates to millions of devices ?