"Note that we did not have to provide the --allow-net flag for this program, and yet it accessed the network. The runtime has special access to download imports and cache them to disk."
Deno the privileged runtime can do these things, but the scripts/code you get it to run cannot do these things without permission.
Specifically I was talking about this section of the posters comment "runs it no questions asked". No, it will _not_ be run no questions asked.
Also if you are just worried about any remote imports anyways, there is a `--no-remote` (turn off http[s] resolution) and `--cached-only` (only resolve remote module if it is already downloaded and saved in cache) flag on `deno run`