Thanks for mentioning GrapheneOS. I'll just explain to others what "pretty trivially" means here. GrapheneOS adds a huge checkmark "Network access?" when you install an app. It's impossible to miss.
It used to be you could let Onkyo App™ access the five IPs for onkyo.com and be done with it.