There are defences for this: If one controls/monitors for every app in system for network access, as soon as any unusually network access are triggered, it is investigated and block.

In my home windows setup, only windows defender, firefox and chrome are allowed out going internet access in regular base. Everything else are blocked.

Windows update are only allowed when I in the mood for it (~once a year). Anyone can do this easily by control srvhost.exe 's internet access with windows firewall app.