It's annoying that this has become the norm with basically zero consequences for bad actors.
Seeing this article made me thankful for GrapheneOS. I've been dailying it for a few months now. Every single app is explicitly granted network permission (or not) upon installation. Local apps like this definitely don't get network perms, and neither does my keyboard app (that always creeped me out.)