Agreed that it's a se-inflicted problem. Like others have stated, restore the network-access permission and have it disabled by default with a big warning shown when the user attempts to enable it (remove the warning if the app has been verified by google).

This has nothing to do with malware. The sleazy fucks at google just want absolute control over our devices. It's as simple as that.