Maybe your coworker should try installing Little Snitch and watch the attempted connections to apple servers.
For example: http://imgur.com/a/tBDrt
These are pre-login connections, and with the exception of Flux and Citrix Receiver, all the processes belongs to Apple. Why do they have to connect at all?
• captiveagent detects when you're on a captive-portal network, it does this by checking for known-content domains apple controls
• helpd is the daemon that connects to Apple's online help docs
• locationd powers location services
And so on. These are all easy to google. Come _on._ >:[
> Does anyone know what the nbagent process is?
> ...
> It appears to be something related to Software Update and/or the Mac App Store, so allowing it seems safe. I'd speculate that it showed up in the latest OS X update since I'd never seen it before today either, and the first google hits seem to appear only very recently.
Sorry, while honest good effort, that's not acceptable answer. And that's before we start investigating processes that do connect AFTER login - what the heck is "systemmigrationd"? (try googling that).
Sorry, but macOS regarding privacy is almost as bad, as Windows. It has many processes that connect somewhere, it is uncertain what these processes do, etc. How can someone even audit that?
Compare to CentOS/Fedora, where the only hit to internet during pre-login is either DNS or your configuration and all the other hits are user-initiated (except browsers, which do update their certification revocation list, unsafe-urls list, etc).
So how does an Apple computer manage to do the following, without contacting Apple servers:
iCloud, iMessage, Apple software updates, Apple store?
Which of these are diagnostic (I said no to that dialog box on install) or iCloud syncing (which I don't use)?