No, you’re absolutely right. That’s what happens when you have the WaaSMedic service running, which cannot be easily disabled in services.msc. I would think I had finally gone the “full-nuclear” option and broken al updates by disabling and stopping the update services (that I knew about), but they would re-enable themselves without fail.

This comment explains where you need to disable it (if you want to go that route).