Since the Windows 98 days Windows Update has used an IP address rather than DNS lookup and it also bypasses the hosts redirect file and any other stuff that attaches to the TCP/IP stack, and then the web site and updates themselves and cryptographically verified.