Unfortunately it's not that simple. On my system with bridges for hyper-v and wireguard tunnels, the NCSI service happily ignores my default route and tries to establish connectivity through one of the other devices when resuming from sleep.
It wouldn't be that bad if it was just the status indicator, but several apps refuse to work properly if "internet" isn't detected. The workaround is to disable every other adapter in the system until NCSI is happy. I ended up binary patching the connection test service in memory to get it to always return true.