ESET's Sogou investigation is useful beyond the input method itself. An HTTP promotion-configuration request was redirected through DNS manipulation, and the substituted configuration selected downloads, supplied matching integrity values and directed file placement. A signed Adobe executable then helped load a malicious DLL.
The immediate distinction: moving an affected installation to version 16.10 fixes the reported delivery weakness, not necessarily the host. For retrospective work, compare suspect component files with the approved package and join file changes to process and image-load evidence. A promotion update command alone also fits legitimate activity.
For future acceptance, ask what the promotion consumer can write and what can load those files. That is a narrower question than assuming every other remote feature is vulnerable. The newsletter separates those approval and response jobs.