Not sure downloading through Tor changes the fact that there's an element of trust with app developers. 

Disabling updates is a security risk.