They literally gave it a proxy to the internet (artifactory). The only thing between the model and the internet was Artifactory.

You can take far greater measures to lock down external traffic than just that.

An offline package cache (aka artifactory WITHOUT its own internet access) likely would have precluded this whole thing.