The Microsoft Update team has posted a statement addressing the current community discussion on Windows Update's self-updating behavior. The upshot is that a longstanding procedure in Windows Update requires it to self-update before it is able to recognize that new updates are available (note: WU does not conduct a self-update event each and every time it checks for updates). This self-updating is done regardless of whether the user has enabled automatic checking, download and/or installation of updates. It does so in an effort to avoid WU misleading the user to think s/he is up-to-date simply because s/he was not receiving notification that updates are available. Put another way, WU cannot alert the user that there are security updates available if it is not in the necessary updated state that will allow it to recognize those updates (see "chicken and egg" dilemma).
However, we do recognize that we should have been clearer in our explanation of this process earlier in the game; the MU team's blog post is an effort to rectify that oversight.
In short, this is a poorly understood process, so I invite you to take a look at the details in the MU blog post to learn more.
Questions on this behavior are best addressed directly to the team via the MU blog.Microsoft, Windows Vista, Security Update, Microsoft Update, Windows Update, Automatic Update,
Source:→ Windows Vista Team Blog