See this comment: https://news.ycombinator.com/item?id=35862698

If you implement socket activation and use an empty network namespace your service can be totally disconnected from any network and still handle requests (because the socket FD it listens on was inherited from systemd). This makes exfiltration much more difficult.