After installing Magento 2 using the composer method, the update folder that is used to create the project with remains. I cannot see any reason to keep it after installing the composer dependencies.
Is it safe to delete?
Best way is to make it inaccessible. That way you make sure modules that depend on the
update application to be (physically) present, still work.
This can be achieved in 2 different ways:
pubyour document root (best)
After doing this, it'd be nice to make a module which removes the inaccessible link to the update application in the admin.