One more thought on the OAI vs HF thing:

If you are wondering how serious network isolation is at these companies, try to install an arbitrary subset of their tech stack without Internet access. Good, now try to install updates!