Maybe Microsoft are trying to foil m.i.t.m. attacks against their infrastructure, by reporting back certificate errors for those domains. A hacker who is developing an attack against Windows Update will need to implement a mock version of the service, redirect dns, and create self-signed certs for those domains. I think Microsoft are interested in people/organizations doing that.

Of course, this is not foolproof, and documenting the feature will just alert people they need to mock telemetry and this pinning feature first.