A printer on a LAN will often find a way out to the internet. Sure, you can firewall it if you think to do that. Another way to auto-update firmware is that the printer driver on your computer fetches the upgrade (your PC can certainly get to the internet) and then installs it on the printer.