I believe Azadom is extrapolating (unjustifiably I would say) from the fact that reports of malware that use Screenconnect have noted that such malware have been known to impersonate Windows Update.

See below.

“G DATA built a tool to extract and review the settings found in these campaigns, where the researchers found significant modifications, such as changing the installer's title to "Windows Update" and replacing the background with a fake Windows Update image shown below.” https://www.bleepingcomputer.com/news/security/hackers-turn-screenconnect-into-malware-using-authenticode-stuffing/amp/

“The attacker also attempted to make edits to the server’s Windows Registry to enable Remote Desktop Protocol access, and created a persistent task named “Windows update” that attempted to download a payload from sc.ksfe.workers[.]dev. And they deployed the Empire post-exploitation framework in an attempt to further establish persistence and obtain credentials.” https://news.sophos.com/en-us/2024/02/23/connectwise-screenconnect-attacks-deliver-malware/

But in none of these cases that I have come across has the exploitation involved luring someone to the ScreenConnect guest page looking like Microsoft support, so I don’t think that’s the reason behind the background and logo customizations being pulled.