I do a lot of automation of just this kind of thing with my Customers.
If you've got an Active Directory domain I'd recommend using Group Policy to execute startup scripts to update EXE-based products, and Software Installation Policy to update MSI-based products. It takes a bit of work, but you're trading your time for the cost of a licensed "application management application". Group Policy Software Installation Policy and Startup Scripts run under the computer's SYSTEM context, so credentails to perform the updates isn't a concern.
If you don't want to roll your own, you can get something like a KACE appliance. In that situation, you're basically just paying a subscription fee for someone else to work out how to automatically deploy the updates.
Basically, you're either paying somebody else to manage updates for you (either via "smart" software or via a "mechanical turk" metaphor), or you're doing the legwork yourself and spending your time / salary on it.
What you're looking for is a tradeoff of your time and energy for money. Be aware that you'll have to develop a lot of specialized knowledge to "get good" at doing this. You can get documentation from Microsoft re: software installation policy and group policy. Bear in mind that you'll need a decent understanding of how the Windows Installer works if you want to be able to handle sticky corner-cases effectively.
In terms of startup scripts and changes when new updates come out, that all depends on the manufacturer's setup program. Ultimately, what you're doing with startup scripts to manage updates / installations is running the manufacturer's setup program in an unattended manner (with whatever dodgy hacks you have to do to make that work). If they make major changes to their setup then you may have to make major changes to your scripting infrastructure. (The same scripts that install Office 2007 work for me to install Office 2010, for example. That was one where we just got lucky...)