We deploy the version without the bundled stuff at work and we disable the auto-update since we push it ourselves internally. I don't see any other way to keep

We deploy the version without the bundled stuff at work and we disable the auto-update since we push it ourselves internally. I don't see any other way to keep ourselves safe. We also add the SHA256 checksums of the versions with spywares to our EDR (aka antivirus) platform to automatically quarantine them if someone attempts to download those. For my personal use I use Mountain Duck, and I can mount those as drives which is nice (I'm not affiliated with them).