I just (two hours ago) experienced that despite if have set terminal.exe as READONLY it has been updated. Happened today 23.05.2017 but the shown date of the latest change was set to 21.05.2017.
I am sorry to say - this kind of behaviour is for me related to viruses or ransomware but to to a financial software that wants to manage my money!
I think you are mistaken, Metaquotes regards this as a feature rather than an error.
Previously I reported them that I could bypass an update by refusing to enter the admin password (#105259 as part of the horrible update from 1031) - that's not what the wanted and now it is different.