WU allows hardware manufacturers to silently install literally anything based on hardware ID matching and the only way to prevent that is to disable WU driver updates entirely (via GPC/registry).

In my case the maker of my motherboard installed a persistent “self-repairing” (i.e. difficult to uninstall) from yet another third party. Naturally, I will not buy a product from them (MSI) again.

Another way to put this is: windows update will install malware w/o user approval in the background.

You can probably turn that off from the BIOS. It's (unfortunately) pretty common these days, MSI isn't special for doing this.

It's a different mechanism from Windows automatically loading drivers and/or the vendor's malware when you plug in a device.

I think the difference is that I chose to install Chrome/Firefox etc, so I don't mind the automatic updates.

In this case nobody actually installed this app by choice!