Probably for the same reason that people use cut&pasted code snippets from random sites to generate self-signed certs.
I.e. nobody freaking understands how this certificate crap works. Microsoft has a set of tools for cryptographic operations that hasn't changed much since late 90-s and probably only a few engineers in Microsoft know how they work. Coincidentally, these tools prefer CABs for file containers.
Posted Nov 20, 2012 22:39 UTC (Tue) by khim (subscriber, #9252)
[Link]
I think you are overthinking things here. Microsoft uses CAB because CAB was designed for such use from the beginning.
The only question which can ever be asked is: why have not Microsoft switched to some other non-proprietary format and if you frame the question like this then the answer is self-obvious, isn't it?