As far as I know (could be wrong) it doesn't even listen to any network ports until its provisioned
Ah, then yes, it seems, and you should be right (at least in principle - I'm not sure, either) with regards to network ports. (I've done some light scanning out of curiosity, but that's only anecdotal...)