But that is not external right?
Depends on what you mean. Kaspersky has two versions, one that you can configure locally and control on every device, and cloud version where all settings are configured externally in the cloud and then applied to each device, so you can control and monitor everything from a single control panel.
In terms of external devices, they also get hacked and that’s how hackers got into fed networks recently.
Everything can be hacked, but at least with Kaspersky you can control what actually happens on your devices, vs hoping that your external device wasn’t hacked and no one is doing anything unauthorized on your machines.