They use (at least) public key certification and TLS/SSL. Beyond that, there's probably a few proprietary secrets involved.
Here in the MS privacy statement (as referenced by Windows Help when searching info about updates) was the closest 'direct', plain-English reference I could find showing they use SSL to transfer information.
Aside from that, and assuming your scenario:
To pull this off the black-hats would either have to gain control, or spoof the MS update servers, or convince your copy of Windows to go to another server.
They would also have to correctly encrypt and sign the fake updates they are sending you to convince your Windows they are legit, or hack your Windows to accept their incorrect encryption.
If they could hack your Windows machine and change those things, then they've already got all the access to you they need.
If they wanted to hit a broad audience via Windows Updates without hacking each machine, they'd have to do it via the fake/spoofed server method, which would be exceedingly difficult.
Hope that helps ease your fears... :)