Do I need this download?

A remote code execution vulnerability exists in Cryptographic API Component Object Model (CAPICOM) that allows an attacker who successfully exploits this vulnerability to take complete control of an affected system. CAPICOM can be used as a component of a 3rd party webpage, script or application. You can protect our computer by installing this update from Microsoft.

http://support.microsoft.com/kb/931906

http://www.microsoft.com/downloads/details.aspx?FamilyId=CA930018-4A66-4DA6-A6C5-206DF13AF316&displaylang=en

You get prompted to install this if you install older software that uses it or you recently used a windows mobile device to a computer and it enabled capicom. This happens because your system *now* makes use of CAPICOM (after having installed a new software/ActiveX control and/or updates for that one) or at least
it's Certificates.

http://www.microsoft.com/technet/security/bulletin/ms07-028.mspx -> Vulnerability Details -> FAQ for CAPICOM.Certificates Vulnerability

http://en.wikipedia.org/wiki/CAPICOM

It is discontinued and Microsoft suggests replacing CAPICOM with .NET Framework's X509 Cryptographic Classes and a number of other alternatives.  But it can still be triggered as mentioned above and in such a case WU will want to patch it.