There is logic--not sure I can describe it well, but I'll give it a try. I
know that other anti-malware vendors operate similarly---Symantec, as an
example.
The definitions available at the portal URL are the latest available--they
may be changed as often as every few hours, depending on circumstances.
There is a higher bar for definitions to be pushed out to autoupdate or
WindowsUpdate--typically these are revised far less often--perhaps once or
twice a week, again depending on circumstances (what is new, and how
widespread is it.....)
So--if you believe you have a problem or have a strange looking file that
you want to get the best current opinion on, go for the definitions at the
Portal. The vast majority of users can just let AutoUpdate do the work
invisibly, and not worry about it. If something needs to be pushed out to
everyone, it will be.
There's a pretty high cost both in bandwidth and in CPU cycles on customer
machines for every AutoUpdate. If the "cost" were negligable, as with spam,
I'm sure we'd see every update produced--but it isn't.