If a service is set to "manual," it doesn't necessarily require user action to start it. Sometimes another process/application/what have you will call for the service.

Of course in this scenario you may want or even need that process running. The real issue is the underlying security of the system. Calling processes silently in the background is a good vector for malware.