I stand corrected. I inaccurately assumed that the Exchange 2007 installation slipstreamed the rollups. We reached this conclusion because the installation process ends with a recommendation to check for updates. The corresponding action opened Microsoft Update, which, for SCC nodes, reported no necessary updates. With our first dozen mailbox server builds, we didn't know that SCC nodes are now treated differently (they weren't in Exchange 2003) and concluded that our newly installed servers were in a fully patched state. For future reference, nobody that we've contacted through PSS seems to know what the "check for updates" option that is checked by default as part of the installation process actually does, but it does not slipstream.