Sure, but part of the process of "ironing out" local networks will be an easy way of categorizing what host gets what sort of connection to the internet. A pedometer built into a shoe needs very little access to anything.

but it will need an update if it has a CVE and it shouldn't need humans to update it

In general one would say that, but there would be a category of local host that would mean "we don't trust this device to correctly update its firmware, so that action (and consequently most other network actions) is not allowed".