It doesn't necessarily mean that it's connected to the public internet.

They could be running Windows Server Update Services (http://technet.microsoft.com/en-us/windowsserver/bb332157.aspx) and pushing the updates to the machine even if it is blocked from connecting to anything outside of the corporate network.