There are good reasons to dislike Bambu, but that’s just not true. Looking at a Wireshark trace, Bambu Studio connects to three domains: e.bambulab.com (version check), api.bambulab.com (download updated slicer settings and translated error messages), and mqtt.bambulab.com. The last one I can’t tell exactly what it’s doing, since only the HTTP stuff got decrypted in the proxy.

Maybe the employee downloaded the installer from a sketchy russian hosting site?