Windows 7 Update appears to be compromised?

Actually the way patches are digitally signed, and it has to match up with a Microsoft cert authority while one never says anything is impossible, one can't inject something into the update without first compromising the entire OS's cert checking process.  And in this case, an attacker would be REALLY stupid to go through all that trouble to compromise the cert checking process and then blow it on the actual attack sequence.

"Simply injecting content into the update description" isn't simple at all.  It feels more like a Microsoft patch oopsie than anything nefarious.  Bottom line the update mechanism isn't easily compromised, typically requires physical access or some sort of physical injection of the cert attack (as I recall Flame malware injected itself with compromised USB devices).  It's one of the reasons that Microsoft can do peer to peer updating in Windows 10 and can assure that the bits coming to us from anywhere are still official Microsoft bits.

My point was if something is listed in the update history as failed you can't "hide" that one item, the update database doesn't work that way.

My gut tells me someone oopsie'd on Microsoft's side and I'm doing my best to confirm.

He's looking at the WSUS Console (Windows Server Update Services). It's a part of the Windows Server OS's

Its from a server running WSUS.  Unless you're managing a large network with centralized patch deployment, you won't have anything like that.

What software is the screenshot you posted from, please?

If the update didn't install, it didn't install.  The fact that it's listed in your update history doesn't mean that it's impacted your system.  

If the update mechanism was compromised and attackers were able to inject content then you have no assurances of that. Depending on what vulnerabilities exist in the update mechanism, then simply injecting content into the update description could be enough to cause remote code execution.

That said, this looks more like a font / character encoding issue and isn't necessarily a sign of intrusion.