Well it definitely checks for updates, and it has services for finding nas for dummies that use outside communications. My router policy doesn’t allow it to talk to the outside, but certain docker containers hosted on the nas can access internet via raspberry pi proxy
Occasionally I let it update then close it off again.
libera.chat here, pretty huge mass exodus from freenode.net a couple years ago.
Fail2ban works if they don’t have infinite IP addresses