[supernovae]

but it will need an update if it has a CVE and it shouldn't need humans to update it

[jessaustin]

In general one would say that, but there would be a category of local host that would mean "we don't trust this device to correctly update its firmware, so that action (and consequently most other network actions) is not allowed".