New
#11
Defender makes its own checks for updates, separately from windows update, so it can update its definitions more frequently than the windows update schedule. Flash is only updated through windows update.
My experiments have shown that Definitions updates are blocked by a metered connection, while Flash updates and updates for the Antimalware platform will download over a metered connection. You can see in this screenshot that the Flash update has already downloaded over a metered connection, but the definition update won't until the 'Download' button is clicked.
Personally, I would have thought that definition updates were fairly essential 'for the smooth running of windows', but apparently Microsoft doesn't agree.