It's expensive to hire someone technical enough to: - Perform such an update - Sign off that they performed the update _correctly_ If you need an air-gapped

It's expensive to hire someone technical enough to: - Perform such an update - Sign off that they performed the update _correctly_ If you need an air-gapped system, it's still much easier to set it up so it can update from a USB flash drive and log "I did the update correctly" back to the drive.