Will OS X ever install anything suspicious without my express permission?
It will download anything if you told it to do so.

It will obey your commands, down to self destruct (kill it self) if you ask it to do it.

There are some preventative measures in place (but at your control) to make it safer (from you).

For example the Downloads:



In order to change this setting you would have to enter a Password. In your case it is probably set (by you) to Anywhere, and that is fine if you know what are the risks.

Hopefully you learned a lesson, and in the future close the web site asking you to Update or OK (they mean the same). Anytime you get a pop up asking you to download something that you did not ask for, shall be killed instantly.

Now without further beating the bushes, tell us what site did that and what file did you trash so we can do some surgery.