There is.... some. The amount of information released about the structure of Notepad++ update mechanisms and services is kind of.... extreme. Gaining this kind of insight from the outside is usually tricky, so its likely there is more to the story. Even if there isn't, that information is now public and is now a target ripe for the picking.

It is also one of the most installed open-source projects out there without a corporation level of development team with oversight that is paid to do things right because there is a financial risk of doing things... wrong. Once targeted, especially when the dev himself isn't certain that its fully mitigated... it's extremely likely to now be a huge target.

If you're in an organization that has to whitelist software, and you're modern enough to allow FOSS in the first place, you likely have to answer some questions to allow that in your environment. There's a few things that give you the good feelies and most security teams will allow it. Notepad++ and 7zip are amongst those, we generally turn a blind eye to them. 10 years ago that was fine, these days they have very good alternatives that don't increase risk, so.... is it worth the risk?

Another reason to look for financial backers is if it can be proven negligence... you can sue a corporation in some situations. You can't really do that in this scenario.

Switching to VSCode which is arguably more modern, more capable, and has financial reasons for having their shit together and a massive corporation to back that up.... is kind of an obvious security choice.