[aborsy]

You need outgoing 80/443 to regularly update. Blocking other ports doesn’t help much, since, they could get out through 80/443.

If the incoming connection is limited to VPN, that’s as good as it gets. You have equal or less security when you login to your bank.

[agreement5051]

Good point about banks, however they also have teams of people monitoring for any potential issues!