Hackers breach ISP to poison software updates with malware

Wouldn’t software vendors signing their updates prevent this kind of attack? I would think that’s the norm for this kind of thing.