It won't forget network passwords without a full reset. So if you connect to download firmware then disable the connection, it is one click away from someone re-enabling it. If there's an unsecured network available, you're only 2-3 clicks away from joining that.
With other people in the house using it, the only way to reliably keep it off the internet is to connect it to a network, allow it to verify the connection works, then block it from making any more outgoing connections at the router level. It seems to be ok with this situation and doesn't complain too much.
My original plan was to setup HDMI CEC and lock away the Samsung Remote to prevent people from getting into trouble. But when the TV is turned on vi HDMI CEC, half the time it wants to immediately run the OLED refresh cycle, and will automatically shut off and start doing that unless you actively prevent it from doing so with the remote. This is annoying because they have a setting to run the OLED refresh at night when not in use. It's almost like they sabotaged this use case on purpose to force people to interact with the Samsung UI.
I should have bought a projector, assuming one can still get projectors that aren't similarly infected.