I just read a good article published by the Microsoft Exchange Team:
In Exchange 2003/2007 you were able update your spam definitions by Microsoft Update. With Exchange 2010 standard this is the same. However with Exchange 2010 enterprise you need to have forefront in order to get your spam updates. The following is a quote from the article published by the exchange team:
"With Exchange Server 2010 Enterprise CAL anti-spam definition updates will not be provided by Microsoft Update. They will be made available via Forefront Security for Exchange."