Don't get hung up on the "copy and paste an url" technique. It could easily be a digitally signed "RepoData.pkgsrc" file that is opened by some aspect of the built-in windows installer mechanism. It could include branding and all sorts of other ways to verify it's identity.

The real win is empowering developers to reliably communicate these updates to users, and make it simple to update, w/o inundating the user's system tray with 5 different bespoke updaters that act out in different ways.