wouldn't this passcode be hidden somewhere in this updater?
No. The update is signed by the key. So.. if any changes are made at all to the files that will be updated (the MBM, etc.) it needs to be resigned to work.
The "key" isn't a file or code that's somewhere inside the update.. the entire update is signed, and then when installed it's checked to verify it matches.
so you don't think that there is any way to get into this?