This may work:
use McAfee Installaton Designer 8.7 and a current copy of framepkg.exe that you obtained from ePO Master repository to produce a custom VirusScan installation package.
(ID 8.7 has an option to embed framepkg.exe as well as any VSE patch, new DAT, etc.)
Edit VirusScan AutoUpdate task schedule in ID so that it updates "when Idle" or "At Logon", etc.
Check the box near the end during ID configuration that says: "Update VirusScan Enterprise at the end of installation".
Use this custom VirusScan install set when preparing your image.
When you install VirusScan onto the image workstation/server, VirusScan will update itself due to the checkbox above and due to the valid sitelist that framepkg.exe has within. If you burn the image later on workstations, standard AutUpdate updates according to the setting above. When MA enforces ePO update task, that one will update.
Do not forget to delete AgentGUID regkey after VirusScan installation as the very last step in image preparation.
NB: Installation Designer must be run on a host that has Virusscan Enterprise 8.7 installed and managed.