Windows Defender uses the same method for updates as Windows Update. And
Windows Update only runs from Admintrator accounts. This is changed from MSAS.
Autoupdate is supposed to work, even for limited accounts, though. And I
believe that also means that the setting to automatically update before
scheduled scans will in fact do that.