It seems like windows update should handle distributing the verified new firmware file if it is also distributing the driver utility to avoid any issues like this post talks about.

That would be a good idea actually, but I'm not sure how viable that is within the current Windows Update instrumentation. Allowing local binaries to fetch random URLs through the Windows Update API is no different from them using the HTTP Service unless there's some kind of whitelisting/validation happening there. The alternative would be that Microsoft uses their own Windows Update cdn to host random firmware files that they're not able to verify themselves. Both cases sound like maintenance overhead for Microsoft without benefit to them.