You noticed it that time - just think of all the other times.
So, you should check to see if you are connected to the internet
before your security programs (firewall/AV/whatever) start. If
connected first, you need new security programs or do some
reconfiguring. That will take care of the worrying part.
That won't stop anything as far as a solicited inbound traffic request
that was requested by outbound traffic from a program running on the
machine behind the firewall that imitated the contact. That Update Agent
sent outbound traffic to see if it needed to be updated. It determined
that a new version was there, and it requested the traffic.
The last I heard the Windows Firewall is the only personal firewall
solution that can get the the connection first during the boot process
to protect the machine from unsolicited inbound traffic on connection to
a network. No other personal FW solution can do it on the MS platform.
I have Windows Update disabled. I control updates. I trust myself a
bit more than I trust that MS will do me a favor. Does that make me
part of the 99.9% or the 0.1%?
Just now restarted to see if the disable would get overridden - did
not.
Well if you have disabled it, then of course its not going to do it,
that is to check that there is a new version of the Agent. On the other
hand, I have notification only enabled with Windows Update, and I
control when the updates for other things not related to the Update Agent.
As far as the Update Agent updating itself without notification, myself
I am not concerned about it.