I think the rule of 2 would work if it kept the 3 from your lethal trifecta. "Change state" should be not be paired with "communicate externally".

And even then that's just to avoid data exfiltration- if you can't communicate externally but can change state, damage can still be done.