I think so. It optionally phones home to see if there are version updates. It optionally phones home after a crash. They have to publish legalese to comply with GDPR because those phones to home store audacity version number, operating system and operating system version number, and country of origin (based on up). It allows them to know when it’s safe to drop support for certain operating system versions.
https://www.swlaw.com/blog/data-security/2015/03/12/why-you-....
But I know Audacity has a sizable European userbase, too.
Also, it's an optional feature. You can just turn it off if it's not a benefit to you.
I swear it seems like there’s a whole generation that doesn’t understand that how to build software that isn’t always phoning home and requires a subscription fee.
An audio editor has an incomparably smaller network attack surface - perhaps even none, if it's sandboxed and makes no use of the network at all.
[0] some plugin host apps do "sandbox" the plugins by running them in a separate process, but this is absolutely nothing like the sandboxing done by browsers. The separate processes run with all the priviledges of the host app process.
Seriously. Don’t do that.
Perhaps that's the current state of things, but like you mentioned with web browsers, it's a thing that can be done if you're willing to sink enough effort into it. Browsers had to go through this process at some point too. There's nothing that prevents plugins from running in a sandbox where the only I/O is waveform in, waveform out.
I've done that in the past, more times than I care to remember, and never have I thought 'Blimey! That's a great use of my time! Let's do it again!'.