Maybe they could do software updates via a USB port as well to eliminate a network connection, but I think your comment is the most reasonable.
I don't think it's reasonable to assume (incoming) internet access at all. The DS200 machine (here in Virginia) has a USB connector, checks for authorized USB drives, and rejects any other drives.
But imagining a state/county run IT department...I can see where there would be laxity and a desire to ignore the security and go with the easier route. I could see this conversation:
COUNTY GOVERNMENT IT PERSON: Sir, we have to do updates on these voting machines to fix a security hole, and in the county there are 40 precincts with an average of fifteen machines, which is about 600 machines. When they got the machines last year, they didn't give us IT people more bodies, and they expect us to go to each of these machines by hand and fix them. We only have three people, and these machines are spread out over hundreds of square miles. I know these machines can be connected to a network, can I do that, and we can push it out to all of them with the special software the vendor gives us to do that?
COUNTY GOVERNMENT BUREAUCRAT: Can we do that?
COUNTY GOVERNMENT IT PERSON: I have heard we aren't supposed to leave them connected, but Dominion says that everyone does, and in any case, it is secure. It would save us a huge amount of time and we wouldn't have to hire more people. I suggest we leave them plugged in to the network all the time, so we can do it on short notice and don't have to go around and plug them all in.
COUNTY GOVERNMENT BUREAUCRAT: Can we do that? Leave them all plugged in?
COUNTY GOVERNMENT IT PERSON: Sure. And if we leave them in all the time instead of unplugging them, it would speed things up.
COUNTY GOVERNMENT IT PERSON: Okay. Go ahead. Hm. What's for lunch today?