This isn't 100% true. You have unrestricted network access from signed java applets if you request the right permissions (and the user clicks allow), for example.

Also, Bram might have come up with a reliable way around the same-origin-policy. DNS rebinding 2.0?