Android's network security model is atrocious, with full network access being in the "other" category that all apps get. You don't need to have root on a phone to go rogue and attack/analyze other devices, if the phone already gives your "no permissions" app full access.

The can only be one logical reason for this: to Google AdSense is more important than your privacy.

I can't take things like project zero seriously when the same company works hard to weaken Android privacy.

So you have an issue with Android's permission model? Fair point, it could be more granular. Are permissions more granular on iOS? Because I'd like to block access to the Internet for some apps that display ads. I'm guessing probably not.

Is there a permissions model on Linux, Mac, or Windows? This issue seems kind of unimportant. If a hacker can compromise the device, they can disregard all permissions.