Correct. Sparkle is an open source updater framework used by many Mac applications for built-in updates. When a vendor publishes an update, it signs it with a private key (which should be kept secret). When the app downloads the update, it verifies the signature using the public key distributed with the app, and proceeds with update if the signature is correct. Publishing private key breaks this trust: anyone can now sign updates, pretending to be the vendor of ICQ.

Edit: I just checked and their updater endpoint is served over unencrypted HTTP connection. If you use ICQ and update it, anyone who can MiTM your connection can install software on your Mac. PR: https://github.com/mailru/icq-desktop/pull/3

For ICQ for Mac users the best way to protect against this is to use Mac App Store version.