I guess you're right, it's in the bottom right, at the left of the lock icon.
I just talked with the scammed guy (it was several weeks ago), the modus operandi was the same (I am not saying my case is a scam, I will never download from anywhere outside the official site), this guy was lead to a different site and after the "update" his satoshis were gone. Also to note here at that time there were not even an official update.
It was quite a huge issue with the earlier versions of Electrum, namely 3.3.3 and below. The issue in question is the server using the dialog box to masquerade as an official update. As usual, it is easily preventable with a validation of the download itself.