If a user sets their Windows 8/7 computer to automatically accept and install updates from Windows Update, what prevents this from being a vector of viruses? Is setting user's computers to automatically accept and install updates a recommended policy for sysadmins?
The two primary things are that your host will be connecting to Microsoft to do it and the updates are digitally signed.
While it is true that an attacker could potentially poison your DNS or your upstream DNS to fool you into going somewhere else to obtain updates, unless those updates are signed with a valid Microsoft code signing certificate, they will not be accepted.
Keeping up to date is very important. A few years back it was realized that a few keys that could be used for signing updates such of this could be derived from other certificates (improperly configured certificates) on the systems. These certificates, however, were revoked and changes were made (that are applied in Windows 7/8) to require longer certificate key lengths.
The recommended policy for Sysadmins is to test Windows updates in their environment before deploying them to users.
For home users, using well known applications, the best policy is to apply updates automatically.