How real is such a network attack?

Question

Information Security

(If it is possible, of course)
If modern programs support the ability to install over the Network, then how realistic is the scenario when attackers, who listen in advance to traffic, inject malicious code / files during such installation of the program by the user? That is, is it possible to launch a Trojan on a user's machine with full access to its network traffic?
And the second question, also related to network security. What could be the reason that after installing the program and rebooting (or just rebooting), you have to re-enter the password to connect to Wi-Fi, although the first time you connected, you clearly checked the box to save the password and auto-connect? And the fact that I chose this particular option "Connect automatically" can be seen from the fact that after the OS starts, there is a connection to this Wi-Fi point, but the connection does not occur (no error is displayed). If you click on Wi-Fi, it just shows the password input window along with the "Connect automatically" option, that is, as if for the first time.

Answer 1

More than real, the first examples of a similar attack can be attributed to the year 99
https://en.wikipedia.org/wiki/Happy99
This is a worm that analyzed network traffic and clung to sent letters.

Answer 2

Attacks of this kind are not just real, they occur periodically "in the fields." There is not quite a substitution of traffic in the response, there is rather a substitution of your server with a file pre-assembled for a specific victim. That is, the victim believes that he is downloading updates to 1C from the 1C site, but in fact (by changing the DNS response, for example), he is downloading a binary from a completely different site, and this binary, in addition to 1C updates, also contains "some functionality" , which implements the tasks of the attacker.
Or even more interesting - they are introduced into the developer's infrastructure, and add "their version" of the update binary either to the update server, or even to the source code repository, this very "certain functionality". And when the package is being built, then from a completely legal update server, clients will receive slightly modified updates. See the story of MeDoc and the Petya ransomware. Scientifically, such an attack is called a "supply chain attack".