That sounds more promising. The site might be able to store data and then send it the next time the page is loaded. I think at the end of the day, a malicious dev could probably find a workaround to most implementations. Might just be better to vet out sites and use reputation to state they are truly offline.

I hear what you're saying, but I also believe this to be a solvable problem

Note that the "offline" mode in devtools doesn't kill any websocket connections. It may have other holes i'm not aware of also.