Even without any network connection at all, windows update will quietly revert system changes it doesn’t like. You can go in as a trusted installer or whatever the highest user space auth is called these days, completely remove the execute permissions to windows system binaries, power down the system, and when you turn it back on again there’s a chance that the permissions will revert.

At this point it is honestly a bit of a miracle that the windows update layer hasn’t been hijacked for malware. Or maybe it has and we have no way of knowing.