On GrapheneOS there is a Network permission to forbid access completely. Or you can also use something like NetGuard[1], to have more flexible controls.
The internet permission never meaningfully protected anything on stock android since you could always just send an intent to the browser with the payload stored in the GET parameters.
I have yet to see a single report of an app utilizing this to circumvent lack of internet access
Hard for you to restrict access of third parties. Easy for you to restrict your own.
That would make all the spying and surveillance harder and thereby reduce profits. And profit reduction is really the worst attack risk of all.