Making full network access a mandatory always-on permission was a huge security mistake IMO. Every app can port scan your network, and probably some do as part of fingerprinting (some websites do at least, and I assume apps are more brazen).