Before running bspatch.exe on baseimage from file system the Installer.patch should test its checksum. If the value is not equal to the expected value no patching should happen and Installer should report error on corrupted baseimage. The same applied to all other installer flavors that use baseimage from file system and not from resources.
Expected checksum value should be calculated at build time compiled in installer code (C++ constant or resource).