Maybe it first worked like that, but it's certainly no longer the case in newer versions. I've personally compromised a not-network-connected TV using only broadcast signals.

HTML+JS can be pushed via the "DSM-CC object carousel"