They host the servers. They know your current IP and current login session to the app store at all times. Of course they could ship a signed update to only you with a court order. How do you think beta channels work?

Maybe judges do not realize they have that power yet, but they will eventually.

The CCP certainly understands this well, which is why they seized the HSMs governing encryption and binary signing for Chinese citizens.