I feel a bit silly being excited about this, but of course there's a circa 50s office solution that requires no batteries and electronics. I don't know what I was thinking!
What I mean is there are three vectors for attacking a label printer: physical access, local network access, and internet access. If an attacker has physical access, your problem isn't the label printer, it's physical security. If an attacker has local network access to your label printer, your problem isn't the label printer it's network security.
There are use cases where internet access is worth a security risk. In that case, device choice should reflect the risk. Consumer hardware has a different risk profile than commercial hardware. Enterprise hardware has a different profile too. Same with custom bespoke solutions from consultants.
Updating the kernel on a consumer device typically means connecting the device to the internet because an internet connection is the most consumer friendly way to update it. For consumer devices convenience is generally more important than IT security.
My gut reaction that led to my response is that security requires engineering analysis of budget, risks, and rewards. Hardening the Linux kernel of a Brother label printer isn't better engineering because the IT problem it addresses is more fundamental. Again, sorry for making you feel silly. It was not my intent.
Instead I bought the cheapest Brother on Amazon...it doesn't connect to the internet, just sits in a drawer. Maybe if I come across a Dymo in a thrift store, I'll have one too because they are kind of cool.
Which reminds me, about 25 years ago I had a Kroy 80 in my studio. The Kroy 80 is a Dymo on steriods. https://munk.org/typecast/2012/08/17/kroy-80-80k-sales-broch...