Google can do that, too, through the "Play Services" framework, in case others weren't aware of it. We know this because Google has already used these "powers" to uninstall apps/malware from phones (non-Nexus).
In fact more or less any app that can be convinced via IPC to open an attacker-controlled URL can be used to circumvent the expected meaning of the internet permission.
And then there's the inconvenient fact that virtually all apps need it for one reason or another, so it just became meaningless. Good riddance, I say.
Paragraph 2 of this page: http://arstechnica.com/gadgets/2015/10/android-6-0-marshmall...
This sentence is as much context as the article provides, and I won't rehash my other comment, but this could be from a recently purchased ~$20 burner to a ~$800 iPhone. Not every phone is windows/android/apple and connected. idk, I found it pretty eye opening.