Did someone say it was connected to the Internet? You’re assuming that’s what’s happening. There are plenty of reasons to spin up an OS to test something that does not require the Internet. And I’ll even go a step further and say that the security updates may not even be needed depending on what you’re doing if you are connected to the Internet. Most security updates are to prevent things from happening after the user interacts with something. If you’re not interacting with these things and your PC isn’t in the DMZ then there isn’t much concern.