nobody verifies all packages that are automatically downloaded all the time, unless there is a problem. We got lucky, that time.