I recall reading about some pen-tester or white hat security tester who, when confronted with a physically isolated system, asked "How do you update it?" However updates were applied was the potential attack vector.