I'm sure automated updates were covered in EULA. Not that I agree with this MS step though (see my other comment in this thread).

You are probably right.

In that case could not the president issue an executive order asking NSA to use the hack to protect everyone?

NSA doesn't have legal power outside USA. That still would be illegal hacking with potential political and/or legal backlash. I understand what you mean, but that's grey area at best.

They don't have any legal authority to spy on everyone either. Didn't stop them and after it went public, did anything meaningful happen about it?

Our German chancellor, Angela Merkel, went from "this is unacceptable and can't happen under any circumstances and there will be repercussions" to "please don't do it" after the Snowden leaks went public.

There is little political backslash and no legal one. The spy agencies (NSA, CIA, GSHQ, BND, #insertanotherhere) do whatever they want with little to no oversight. And if the public finds out about it, the first move is to legalize it by law and continue as before.

You do know that the exploit came from the NSA in the first place, that they somehow failed to keep it to themselves and it got released to the public.

NSA probably did some forced update of their own.

Yes, and litigation for it is ongoing in several countries.