It's poorly worded for sure. Perhaps the object lock servers: * run on an immutable operating system, * enforce strict (local) whitelist-based firewall rules,

It's poorly worded for sure. Perhaps the object lock servers: * run on an immutable operating system, * enforce strict (local) whitelist-based firewall rules, * pull, not push, data from other servers, * restrict remote administration to a physically isolated network, * or disable remote administration entirely. I feel like that's as close as you can get to the benefits of air gapped environments without the drawbacks of servers directly exposed to the network. Or, well, unless there happens to be a 0-day in the TCP/IP stack. It depends on the threat model I guess.