Regarding the original topic: I suggest to generally disable features that make external connections, once they are known. Add some toggle that allows the user to enable them. State somewhere on the website that Joplin aims at minimizing its "online footprint", i.e. make little to no external connections, but that this is not guaranteed.
This would align both with the goals of privacy and with the goal to not become too entangled with chasing external connections for each release of a component that Joplin uses.