Question about package compression

[William Richards #SaveOurInternet]

Does a package only get compressed when it is updated or when the
compressor used to compress it (e.g. Zstandard, XZ, etc.) is updated? I'm
hoping this is only the case if the program itself gets updated because
this would decrease the chance of exploits and backdoors.
I'm asking this for a friend and they're extremely scared about this kind
of thing.