The same is true if a CA certificate used to secure Windows or Firefox updates (or anything else that contains an updated list of "trusted" CA certificates) is compromised. Replace "CA certificate" with "GPG key" and it's equally true for Debian or Ubuntu (and there must be something analogous for Red Hat, but I don't know how secure-update works in RPM-land).

The only answer is to have as small a list of trusted keys as possible, and be very careful how they're secured...