Most customer fabs run airgapped because they contain some of the most valuable IP on the planet. So pretty much none of the above applies.
It’s mostly legacy hardware and code combined with ASML support contracts. ASML support is provided on-request remote access to the systems, or someone flies out if the customer is particularly paranoid.
ASML would kill for any tracking or diagnostics to be regularly send back to Eindhoven for R&D purposes, but it mostly doesn’t happen because machine diagnostics data is intertwined with the chip IP.