This question already has an answer here:
Is there any way to boot a Mac with WiFi turned off completely, until manually turned on again? (And to be precise - it should be turned off completely and not just disconnected from a network.)
The use case would be to patch a Mac that hasn't been used in a while (and has been powered off) and therefore booting it in an unpatched state is a small but non-zero security risk.
I've searched the web and haven't found any hint (could be me using wrong search phrases) so at this point I'm looking for any undocumented, "obscure" solution that's out there.
EDIT: This question has been marked as a duplicate of Can I disable wifi on boot? System not booting but while it's pretty similar, I believe it's also different, so let me clarify.
The other question is about fixing a system that doesn't boot, whereas my question is about security.
We know that EFI in Macs is able to connect to WiFi to download the Recovery image, or in case of Macs with the T2 chip--to verify the OS if secure boot is enabled.
This means that if the system hasn't been updated in a longer while, the WiFi (or more general: networking) code in the EFI can have known vulnerabilities.
So basically when I turn on such a vulnerable Mac, up to a few minutes can pass until I can disable the WiFi in macOS preferences (let's say is has a spinning disk, so the boot time is significant), and even then the EFI will still be able to turn it on after a reboot.
Now, I'm fully aware that it's unlikely that something bad will happen, but I'm hoping to learn a way to somehow enable "radio silence" mode on boot, e.g. using some magic, undocumented keyboard shortcut.