That wasn't the case a few months ago (maybe a year) where javascript payloads could be loaded hitting IPs on the LAN, so hitting millions of http(s) requests to IOT devices which would then get raw socket support.

Hitting default gateways for web admin panels etc.

I found the solution for Windows update though.Just don't use Windows. Microsoft can't be trusted.