zlacker

Yeah the second rule is: for anything that runs locally and for which your use doesn't require an internet connection: put it on a separate network without WAN access.

I also had to learn that lesson painfully when my network connected Brother printer got a (unasked for and unapproved) firmware update that disabled the 3rd party toner cartridge it was using. It's now blocked from the internet in my router, but it's unfortunately a case of shutting the barn door after the cows are gone.