The software retrieves the data and applies it from a list maintained by the software distributor. This sounds, from the high-level overview they gave, exactly the same as all update servers.
To be fair, for Windows and many Linux distrubutions (don't know about OS X) have signed packages, so it's not like they're grabbing any data and blindly running it.