When you first started your computer and agreed to the Windows TOC, you gave Microsoft explicit permission to automatically install Windows Update "infrastructure" updates - independent of your Automatic Updates settings. [But nobody bothers to read the
TOC, do they?]
<QP>
Anytime Windows Update (or Automatic Updates) is turned ON, either set to automatically install updates or notify to download/install updates, Windows Update will take care of updating itself [i.e., Windows Update Agent].
</QP>
Source: http://blogs.technet.com/b/mu/archive/2014/06/24/upcoming-update-for-windows-update-client.aspx
The following expanded explanation is a tad outdated but still pertinent today:
<QP>
How Windows Update Keeps Itself Up-to-Date
Occasionally, we must update the infrastructure of Windows Update in order to ensure a high level of service quality, reliability, and operation.
As part of this process, we update both the back-end infrastructure that supports the service as well as the client side code (i.e. the Windows Update agent, or client).
So what are we doing this time? Well, this particular update won’t really change the way the client looks or feels to you, but you may notice some improvements in the length of time it takes Windows Update to scan for updates and how quickly
you’ll receive signature updates...
What does this mean for you?
Anytime the Windows Update agent is turned on, Windows Update will take care of updating itself[i.e., Windows Update Agent]. Windows Update is considered “on” when anything other than “Never check for updates” or “Turn off Automatic Updates” is selected.
What this means is that if you’ve selected “install updates automatically,” the update to the Windows Update client will install automatically.
You may also notice that Windows Update will also automatically download and install updates necessary for the Windows Update client to function properly[even]if you’ve chosen a different setting... [e.g., Notify but don't download & install; Download but don't install].
This is done in order to ensure that a system will continue to notify the user about available updates. [emphasis mine]
The Windows Update client does not download or install infrastructure updates if the user has selected...“Never check for updates...”[emphasis mine]
Windows Update has been keeping itself up-to-date this way for many years, and while these infrastructure updates are important to maintain the quality of the Windows Update service, they aren’t that frequent (they usually occur about once a
year).
Why does Windows Update need to self update?
You may be wondering why this process is different from other updates you’ve come to expect from Windows Update. The reason Windows Update issues infrastructure updates in this way is to
ensure that users are able to successfully check for updates and/or receive expected notifications. If Windows Update wasn’t able to do this, it may cause some users to believe that they have all of the latest security updates even though there
was no installation and/or notifications of updates. To avoid a false sense of security, the Windows Update client automatically checks for and installs any available infrastructure updates anytime a system uses the Windows Update service, independent of the
settings for how it handles updates...
</QP>
Source: http://blogs.technet.com/b/mu/archive/2008/07/03/upcoming-update-to-windows-update.aspx