This is concerning me as Windows Update should always be a trusted site and digitally signed.
Let's see..
1]
Windows updates are not a website.
Those are two different things.
2]
Windows is not signing all their files.
In fact they only sign a real small amount of their files.
And "the warning will not been shown if more people that are using avast have downloaded the file..." doesn't make sense here either, as it's Windows Update.
It does perfectly make sense.
avast checks how many of their users have downloaded that particular update.
Do you really think all 200+ million of avast users are downloading the update within seconds after it has been released?
MS, just as avast and many others, role out updates to people spread out over a certain time period to avoid overload on the servers.
That means that it will take some time that everyone will (or can) get the update.