I could enable LAN mode and trust the mode does what it says.
I could trust others firmware reverse engineering to verify LAN mode does what it says.
I could isolate it on it's own wifi and I could block it at the home firewall from accessing the internet, to be sure.
But it was easier to simply leave it off my network.