Yes, you should be terrified!
One could argue a good case that it is negligent for Intuit to require the user to run a program that is not verified to be from Intuit.
If Intuit can't get this to work, do you trust Intuit to protect filing your returns electronically?
If Intuit would supply a hash, then at least the user could verify the file, e.g., "certutil -hashfile UntuitUpdater.exe SHA256"
If you get this resolved, would you please post?
