Looking at the firewall logs it seems the devices try to ping (ICMP type 8) a bunch of AWS IPs every few hours. The controller tries to connect 80/443 on different AWS IPs a lot more often, even without me navigating the web interface. Other than that, no ill effects. Device firmware update notifications are gone, just says "up to date" now.
Interestingly, I still see the ad for their "dream machine" on the dashboard, as it seems to be baked into the controller. It's also trying to load external resources from "net-fe-static-assets.network-controller.svc.ui.com" while navigating the new web interface. The "classic" interface still seems to be truly self-contained. Using the latest controller version as of today (6.1.71-15061-1).
Condensed firewall logs for reference below. Not that it matters much, but why not.
Unifi controller VM:
zgrep unifidrop /var/log/syslog\* | grep "SRC=$unificontroller" | awk '{print $12, $21}' | sort | uniq -c | sort -h
5 DST=13.224.246.17 DPT=443
5 DST=143.204.174.59 DPT=443
5 DST=143.204.174.83 DPT=443
5 DST=34.210.116.187 DPT=80
5 DST=34.211.38.191 DPT=80
5 DST=34.218.198.60 DPT=80
5 DST=99.84.5.14 DPT=80
5 DST=99.84.5.24 DPT=80
5 DST=99.84.5.51 DPT=80
5 DST=99.84.5.82 DPT=80
7 DST=13.224.246.67 DPT=443
7 DST=13.225.74.11 DPT=443
7 DST=13.227.220.19 DPT=443
7 DST=13.227.220.38 DPT=443
15 DST=54.201.165.155 DPT=443
25 DST=44.239.243.150 DPT=443
28 DST=44.238.226.202 DPT=443
28 DST=52.89.51.163 DPT=443
28 DST=54.218.175.125 DPT=443
zgrep unifidrop /var/log/syslog\* | grep -v "SRC=$unificontroller" | awk '{print $12}' | sort | uniq -c | sort -h
2 DST=13.224.230.94
2 DST=143.204.9.24
4 DST=99.84.6.169
6 DST=52.84.94.172
6 DST=54.230.54.165
24 DST=52.222.138.169