Same. I tried making updates the security boundary too but it's not enough. Now public services terminate on a disposable VPS and reverse-tunnel home only where needed, although even that exception keeps shrinking. Pangolin ;)