"investment for retirement is way different than owning a VC firm"
I'd challenge that idea if you're trying to pass a moral judgement. It's no less wrong or immoral to uncaringly invest in companies that do horrible things for ones retirement in a 401k than it is in invest uncaringly in companies that do horrible things for VC, starting a new business or any other investment decision. We all bear responsibility for the effects of our own decisions, whether small in scale or large. Whether small or large investments, if we all took care and interest and time to receive and made changes where we see immorality, the world would be better for it.
Who gets to draw the line between those who are just "retiring" and bear no responsibility for the effects of their investments and those who are so wealthy they should? Who gets to decide what that amount threshold is? You? Why wouldn't everyone be held to the principle if you're making a judgement based on morality? Gets to be a very slippery and subjective slope otherwise.
"The exact technical mechanism remains under investigation, though the compromise occured at the hosting provider level rather than through vulnerabilities in Notepad++ code itself. Traffic from certain targeted users was selectively redirected to attacker-controlled served malicious update manifests."
Fuckall they could really have done about it other than changing host providers, which they mentioned they already have as a result.