[averageRoyalty]

The way is to not install third party software with kernel level access that you can't stop pulling remote updates.

How does that pass a security audit in the first place?