It as far as I’m aware also gathers data, how do you think Microsoft get all that data on infected systems, etc.

But again if your system is already protected and the windows update has got to know that from the Windows Security/Action Center. It shouldn’t be offered as either Important or Critical (I can’t recall the one it is under) when your system is protected.