Wow, that's heinous. At worst they could use a VPN, and at best they would just download firmware updates or poll for config changes from the Internet the same

Wow, that's heinous. At worst they could use a VPN, and at best they would just download firmware updates or poll for config changes from the Internet the same way other clients on the network do. Out of curiosity, do you remember what brand(s) and or product(s)?