You're wildly wrong.

Every single thing you just mentioned both occurs and doesn't occur with both web and native apps depending on what the app was built to do.

- Web apps can require internet

- Web apps can not require internet

- Native apps can require internet

- Native apps can not require internet

- Web apps can inform a server about what you're doing

- Web apps can not inform a server about what you're doing

- Native apps can inform a server about what you're doing

- Native apps can not inform a server about what you're doing

- You can unplug from the net, install desktop software (native app) and run it without it being able to send anything anywhere

- You can not unplug from the net, install desktop software (native app) and run it without it being able to send anything anywhere

- You can unplug from the net, install desktop software (native app) and run it without it being able to send anything anywhere until you plug back into the net

- You can unplug from the net, install desktop software (web app) and run it without it being able to send anything anywhere

- You can not unplug from the net, install desktop software (web app) and run it without it being able to send anything anywhere

- You can unplug from the net, install desktop software (web app) and run it without it being able to send anything anywhere until you plug back into the net

Source: I make offline web apps.

The average user and use case typically has internet connection so you're talking about edge-case scenarios. In a regular scenario, a native app can send whatever it wants about your system to a server, including your sensitive photos and private information.

> Anything I click on that loads a new resource sends data to the server about what I'm doing.

Nothing stops native apps of doing that. Plenty require you to have internet connection and coerce you into telemetry. The difference is that one can only send data that the browser will allow it to have, while the other can read all your sensitive data on disk.

> The average user and use case typically has internet connection

Clearly you're not poor or living in a developing country.

Or living in a rural area with crappy Internet. I've installed wireless Internet in places where the people are wealthy but could only get a crappy DSL line. An Internet connected app, web or native, was a pain in the butt to use.

Mobile users can have problems too. I still come across dead zones in network coverage that render some apps useless and I'm not even outside of town.

And those people are unlikely to pay for my product

And this allows someone to perhaps gain root access to your machine in what way exactly? Or get access to your private/payment info?

Because this is the very real threat users of desktop apps face.

I am not at all concerned about an application developer having access to data about my usage of his app. (In fact I have a hard time empathizing with people who are so concerned).

I am extremely concerned about an application developer having the run of other data which has nothing to do with his app, which is always the case on a general purpose computer, except insofar as it’s been made into a walled garden.