Comment by prmoustache

You install it from them. Past the initial install they get OTA updates.

Having said that it doesn't prevent them to check the "enable network" option when installing apps.