I have never been a big enterprise integrator, and I thought exactly like this.
Then in 2024 the CrowdStrike BSOD screw up happened, and I was surprised to learn that no, not everything is airgapped. Apparently, businesses are okay with untrusted, unvetted, self-updating pieces of code that run in kernel mode.