<snip quotes>
Since I install with Internet access disabled, including during the "post-install" restart, it should be clear there's no way for those checks to "see" information about "emergency" or "micro" updates, etc. etc. Presumably, starting the UI to check About would only be able to show the .zero at the end. Presumably that would also mean that the restart would happen with no "corrections" and be subject to all initial bugs that have later fixes. I consider the process you describe as altering what was installed behind my back.
This really isn't behind your back, it is what a resident on-access antivirus does.
You aren't starting the UI as such it should already be running after installation not when you open it as such. It checks for VPS updates Which as I said included engine updates (the scanning engines/elements) and the emergency update check is a scheduled task.
Unless you completely unplug the internet cable or WiFi then a connection would be available.
I don't feel comfortable moving to 19.8 as originally released.
If that is the case you shouldn't have updated in the first place and waited, there is nothing to stop you setting the Program Update function to Notify but not install or set to Manual (Ask when an update is available).
If you are still uncomfortable, then I believe your only way would be to start from an earlier version 19.7 if you saved a copy of the off-line installer or can find it at a download site. When installed before restart set the program update to Manual.