If you wish, you can ensure that the compilation step in particular doesn't need/use the network, by first fetching the dependencies:

  someproject% go get ./...

Next disable network access for the go command, or for the whole system.

Then compile:

  someproject% go build

That's true. However, because of the design of go tooling, you still call the same command line method to get the tool to compile your code.

This leads to the compiler having access to the internet and possibly exercising its access. In a perfect world of separated concerns the compiler binary wouldn't have any networking code at all, necessitating a go-get before calling go-build.

I understand why the Golang team decided to go with this approach, but it does have side effects that people coming from different tooling (say, C) wouldn't expect.

Sounds like a great reason to adopt Nix! Run each tool in a sandbox appropriate to what it's supposed to do, and store the entirety of the inputs and outputs so they can be audited if the need arises.