[acdha]

They do: the updates are signed so our hypothetical spies would need to have a zero day in Authenticode or to have compromised the signing keys.