If you read Ryan Hurst's blog post (which you link to), you will find that it contains a number of misconceptions. I would not trust anything you read in that blog post to be correct. In particular, most or all of the criticisms in that blog post appear to be invalid.
So, no, as far as I can tell, the WindowsUpdate certificate is not flawed.
No, SSL Labs cannot be used to evaluate the security of WindowsUpdate. I mean, you could probably rig up a way to use it, but that would be a mis-use of SSL Labs: the results of the report may not be applicable, given how WindowsUpdate works. For instance, Ryan Hurst is mis-interpreting the results from SSL Labs. SSL Labs is intended for evaluating public-facing web servers that are intended to be visited by people with their web browser. WindowsUpdate doesn't work that way; it is not a public-facing web service. Rather, most people get updates via a dedicated client that runs on their machine and speaks directly to the WindowsUpdate server. SSL Labs results are not relevant and may not be accurate in that context. For instance, Ryan Hurst's criticism that the WindowsUpdate certificate doesn't validate (with SSL Labs) just represents a confusion over how WindowsUpdate works; it is not expected nor required for the WindowsUpdate cert to validate using the Mozilla root certs, since only the Windows Update client needs to validate the WindowsUpdate root cert, and the Windows Update client does do so properly. WindowsUpdate has never supported Mozilla/Firefox. So this is basically a bogus criticism.
I don't know why the WindowsUpdate server supports SSL 2.0. That's a fair question.
(Please understand that Ryan Hurst's criticisms are orthogonal to the Flame attack. They are unrelated. I'm not sure how they got lumped into this question.)