You install it from them. Past the initial install they get OTA updates.

Having said that it doesn't prevent them to check the "enable network" option when installing apps.