You've added more detail, yet there is still a problem.  Even with auto-updates, not everyone will have the updates at the same time, and if the government has to wait weeks or months for everyone to get the malicious code, they risk getting caught by the source savvy power-users.  And, there are a lot of different clients out there now.  Granted, they mostly use similar code, but each has it's separate routes for updating.  A more plausible attack would be to discredit bitcoins as an evil invention of drug dealers, gamblers, and weapons dealers... oh wait, that is what they are doing!