Windows update fetches all sorts of things now. If the hardware advertises X device then Windows update will check if it has anything for it. Approved vendors can provide all sorts of guff. Historically that has included drivers that intentionally brick your devices. HP probably packaged up some software that updates the BIOS and got it into the Windows Update DBs.

This is something HP should have handled.

If a bad update is rolled out then it’s the responsibility of the software maker partner (HP) and the distributor (Microsoft), not just one or the other.

Those laptops are THEIR products, not Microsoft’s.

Both Microsoft and HP have branding on their laptops and a responsibility post-sale for the reliability of their systems. Hardware, firmware and OS responsibilities are all party to this chain of failure.