If someone hacks Canonical, they can make the whole Snap Store an attack vector without nearly as much effort.

So basically the same as if someone hacked flathub? Or if someone hacked Canonical/Debian/Red Hat/whoever and gained access to their package signing key?