“qBittorrent has had this behaviour from June 2015 until the present, affecting v3.2.1 through v5.0.0 inclusive.”
qBittorrent’s DownloadManager accepted any SSL certificate on installer downloads, update checks, RSS feeds and the GeoIP database. Anyone in the middle could swap in an executable. Version 5.0.1 fixes it, and the maintainers had not committed to a security advisory. Nine years of trusting every certificate is a policy, not a bug.