There's a valid point there.
When I bought a new PC some years ago, before I had a "proper" router with a firewall, I connected it to the internet to download the necessary updates and anti-virus. Before I did that, I watched to see what happened.
The first "probe" into it came after 40 seconds. I'd expected it to be a few hours, which would have allowed me to do the updates.
I downloaded the anti-virus into the old machine, and copied it across to the new one without an internet connection.