Microsoft responds to eWeek’s findings that certain files were being installed on Windows computers even when the auto-update feature is disabled:

One question we have been asked is why do we update the client code for Windows Update automatically if the customer did not opt into automatically installing updates without further notice? The answer is simple: any user who chooses to use Windows Update either expected updates to be installed or to at least be notified that updates were available. Had we failed to update the service automatically, users would not have been able to successfully check for updates and, in turn, users would not have had updates installed automatically or received expected notifications.

Ok, so it’s only the update client that’s updating, and only if some level of auto-update is selected (in other words — if auto update is completely disabled, the updater would not update itself). That seems reasonable, since it would ensure that the updater would continue working at the specified setting even if server-side changes were made by Microsoft. The key here would have been more openness. Why not make sure people know the updater works this way before you have to deal with a PR backlash?