If the device does not listen, i.e. it calls out, then it is inherently much more secure. However, many devices use an embedded web server and do listen for requests.

If the device does not listen, and polls regularly for updates, then that is fine ... perhaps even ideal.