Hopefully, this sort of thing can at least be stopped by very restrictive outbound firewall rules, but it's getting to the point where you have to seriously consider only using dev tools on air-gapped machines anymore.
I never liked Postman and that's how I mostly stopped using it. Completely stops working on analytics request denial and then starts sending reports to Sentry (but even if you allow those, they don't learn, I've tried)