Is there a way to validate that an apple update is legitimate?
On other software updates (and for not having any doubt about the legit of them) sudo through terminal. 

To install all available software updates, instead use the command sudo softwareupdate -i -a. The -a switch simply instructs the command to install all updates. Again, you’ll need to enter your admin password when prompted.

There’s no traditional progress bar, but you will see updated text entries in the Terminal window as each step is completed, letting you know both when certain updates have been downloaded and when the entire installation process is complete.

If you installed software updates that require a reboot, you’ll see a final message instructing you to restart your Mac. You can do this via the normal macOS interface, but since we’re already using UNIX commands in Terminal, you can also type sudo shutdown -r now, which instructs shutdown command to restart the Mac (“-r”) immediately (“now”).