I've done that in the past, more times than I care to remember, and never have I thought 'Blimey! That's a great use of my time! Let's do it again!'.
https://www.swlaw.com/blog/data-security/2015/03/12/why-you-....
But I know Audacity has a sizable European userbase, too.
Also, it's an optional feature. You can just turn it off if it's not a benefit to you.
I swear it seems like there’s a whole generation that doesn’t understand that how to build software that isn’t always phoning home and requires a subscription fee.
An audio editor has an incomparably smaller network attack surface - perhaps even none, if it's sandboxed and makes no use of the network at all.
[0] some plugin host apps do "sandbox" the plugins by running them in a separate process, but this is absolutely nothing like the sandboxing done by browsers. The separate processes run with all the priviledges of the host app process.
Seriously. Don’t do that.
Perhaps that's the current state of things, but like you mentioned with web browsers, it's a thing that can be done if you're willing to sink enough effort into it. Browsers had to go through this process at some point too. There's nothing that prevents plugins from running in a sandbox where the only I/O is waveform in, waveform out.