I don't update unless there's a security fix (haha), i have a problem, or a feature i need is released, at which point i simply disable the outbound firewall ru

I don't update unless there's a security fix (haha), i have a problem, or a feature i need is released, at which point i simply disable the outbound firewall rule temporarily and "force" an update through whatever controlplane the device has (typically an app). For security fixes, i usually find out through other channels (here or reddit) about some new 0-day, and i will check for updates after that. Considering that the devices are not allowed on the internet, and on a very limited network, the risk of a random "drive by shooting" is rather low.