TipI see that the WSUS product team just made an announcement about the FCS update re-offer problem and it’s resolution.  I have the meat of it below as well as a link to the source:

Shortly after the release of our previously announced update for Forefront Client Security, we received reports of a previously released update for FCS (Client Update for Microsoft Forefront Client Security (1.0.1703.0)) constantly re-offering.  The Forefront team has tested and released a revision to this older update to resolve this re-offer problem, and this revision is now live for WSUS servers.

Machines managed by WSUS servers will need to:

  1. Synchronize their WSUS server to download the latest revision
  2. Approve the latest revision
  3. Wait for the client to re-scan against the WSUS server to receive the corrected update revision.

Note: Step 2 is not required if you have configured your WSUS server to automatically approve revisions.

For more information see FCS update re-offer problem resolved.

J.C. Hornbeck | Manageability Knowledge Engineer