It's in the ToS, and there was a big hoo-haa over it at the time it was introduced. Eg: https://news.ycombinator.com/item?id=8473580

Aside from that, the most basic understanding of what Spotlight is reveals there is no other way for it to function other than to send the users input off-machine:

The user types in a value and results are returned related to that value, some, from online sources.