> I think a notable case of the second category is jwt.io which last I checked definitely seemed to fire a few network requests after I pasted a token.

They do make request to https://b.6sc.co/ all the time, regardless of you pasting stuff or just having it as an idle tab. Seems to be some kind of analytics that just tracks your time on the page and if you are active or not. With that said, I just fired up a proxy now when you mentioned it, have not actually properly investigated it.