If plausibly your label printer is an attack surface of significant consequence, a Dymo is the simplest thing that might work.
https://www.staples.com/dymo-organizer-express-pro-industria...
https://www.staples.com/dymo-organizer-express-pro-industria...
“If you’ve ever used one of Dymo’s small 1/4″ or 3/8″ plastic-embossing labelmakers (and who hasn’t?) you already understand how this tool works, and how to operate it. But in terms of construction quality and durability, the Tapewriter is as far removed from those cheap plastic embossers as a Mercedes is from a Kia. It’s 10″ long, weighs almost two pounds, and is made almost entirely from cast aluminum, with steel fittings here and there, and all held together with machine screws. The only polymer in the thing, as far as I can tell, is a rubber friction coating on the internal tape drive wheels.”
What I mean is there are three vectors for attacking a label printer: physical access, local network access, and internet access. If an attacker has physical access, your problem isn't the label printer, it's physical security. If an attacker has local network access to your label printer, your problem isn't the label printer it's network security.
There are use cases where internet access is worth a security risk. In that case, device choice should reflect the risk. Consumer hardware has a different risk profile than commercial hardware. Enterprise hardware has a different profile too. Same with custom bespoke solutions from consultants.
Updating the kernel on a consumer device typically means connecting the device to the internet because an internet connection is the most consumer friendly way to update it. For consumer devices convenience is generally more important than IT security.
My gut reaction that led to my response is that security requires engineering analysis of budget, risks, and rewards. Hardening the Linux kernel of a Brother label printer isn't better engineering because the IT problem it addresses is more fundamental. Again, sorry for making you feel silly. It was not my intent.
Instead I bought the cheapest Brother on Amazon...it doesn't connect to the internet, just sits in a drawer. Maybe if I come across a Dymo in a thrift store, I'll have one too because they are kind of cool.
Which reminds me, about 25 years ago I had a Kroy 80 in my studio. The Kroy 80 is a Dymo on steriods. https://munk.org/typecast/2012/08/17/kroy-80-80k-sales-broch...