Keep in mind that having a remote update process is a security risk in and of itself. So some people might want to opt out from such updates and firewall the device off entirely, if its functionality does not require a live internet connection this should be possible.
What about security bugs in a device's offline functionality? For example, imagine a keypad door lock. It can be configured online to add and remove unlock codes and to set schedules for automatic locking/unlocking, and then goes offline for normal operation.
Suppose someone discovers that certain invalid input sequences will unlock it regardless of what codes are set. I'd say that's a security bug that requires a security update, even though what it is fixing is functionality that does not require or use an internet connection.
https://www.google.com/search?q=smart+door+lock+vulnerabilit...