We use a white-listing app (Carbon Black App Control) in our environment and have specific rules setup to allow these update to installations. Recently, we've been inundated with blocks for Notepad++ 8.1.9 which is now installing from "C:\Windows\softwaredistribution\download\install" instead of CCMCACHE.
Has this install behavior changed recently?
No, nothing has changed. %windows%\softwaredistribution\download\install this is a default install location of the Windows Update Agent and always has been for software updates for a very long time.
The software update content is copied from ccmcache to %windows%\softwaredistribution\download\install at the time of install. You'll see murmurings of this in WindowsUpdate.log (generated via PowerShell function) about it copying the files around, verifying hash etc.
Thanks for clearing this up, it must be an issue with our app control rules. We'll take a look at it and create some new ones.