Construct uses the vs2005 runtime because it was compiled with Visual Studio 2005. This does not make it outdated since Microsoft still supports it releasing security fixes and patches for it on a regular basis.
When installing construct the latest version of the vc2005 runtime is installed. This is the version used, which was released 4/11/2011, much newer than MSXML 4.0 SP3 which was released 9/29/2009.
Are you sure that security vulnerability is still current? The date on the page you linked to dates from 2008.