This isn't even the worst payload ever delivered through Windows Update. The prize for that should probably go to chip manufacturer FTDI, which once abused the system to publish a driver that would semi-permanently brick USB serial bridge parts the driver detected as counterfeit [1] by exploiting a command that the genuine parts did not implement correctly (how ironic) [2]. The backlash was large enough that Microsoft ended up pulling the update almost immediately, but that did not stop FTDI from trying again a few years later with another driver update that deliberately corrupted data sent through detected-counterfeit parts.

[1] https://en.wikipedia.org/wiki/FTDI#Driver_controversy

[2] https://github.com/therealdreg/ftdibrick#diving-deep

Basically, Windows has been installing monitor drivers for a very long time automatically. Usually a single INF file. Recently, companies like LG have discovered and abused that by instead of just that single INF file, they are installing software that pushes malware like McAffee anti-virus onto your computer.

More of a Windows Update + MS partner issue than EDID.

While that is an important distinction, the fact you might need a downloaded driver for a screen is a bit ridiculous to begin with.

The EDID is just a model identifier and some capability metadata, it can't tell Windows to do anything.

It's Windows that decides that it should download a driver from Windows Update because it recognises it hasn't got a driver from that hardware, and it's Microsoft that let the vendor submit drivers that are bundled with near malwareto Windows Update.