Many of the updaters have evolved to have unconfigurable corners or be configurable at construction instead of later at execution time.

This means some updaters talk to the network even when airgap is configured, or don't use configured http clients.