Update.esm does implement updated stuff to the game (the should tell it). You only need to add a dependency of the update.esm if you are aware of editing records the esm updates from the original Skyrim.esm. Otherwise you re-implement outdated records, even if you are duplicating your used records. Why using outdated and maybe broken stuff?
Using Update.esm as master doesn't prevent pirates from using your mod. Just the stupid ones, which don't update or are to dump to do so, can't use your mod. But legal users, who don't want to update their game for compatible reasons, aren't also unable to play your mod then.