If you stay up to date with Ledger's subreddit on reddit.com/r/ledger, you will know when a new LEGITIMATE update is available. So when there is an update, it may be a good idea to first verify their Twitter account, their subreddit and their blogs to check if a real update is out there or you are getting a fake notification.
I always check their GitHub to see what the newest version is and what changes have been made.
Ledger Live Desktop Releases Unless my current Live has a vulnerability, I typically wait at least 24 hours before updating my software. That is because should there be a problem with the next version, I will hundred percent hear about it on Reddit. I am just giving it enough time to be tested by other members and any big issues will come up mostly within a day.
Good man. I wait even more. Up to a week or two. The changes and fixes are usually not that important to make me hurry and install an update too early. They usually fix certain unimportant features involving altcoins or improve something I don't use anyways.
It is possible, but if it happened, it would come from Ledger directly. Ledger Live servers are not operated by a community of volunteers like in the case of Electrum. They belong exclusively to Ledger. Ledger and its team would have to go rogue for something like that to happen. In Electrum's case, all that was needed was that one or multiple server operators became malicious and started broadcasting those fake messages.
