Android's network security model is atrocious, with full network access being in the "other" category that all apps get. You don't need to have root on a phone to go rogue and attack/analyze other devices, if the phone already gives your "no permissions" app full access.