I agree that in some cases there is a grayscale because what is an important behavior for some users may be unnecessary for others. For example, i could accept that incremental search using Google when text is entered to address bar in a browser could be considered both useful feature and privacy violation depends on user expectations.

But i also think there are some clear lines, like if a tool is not expected to use network at all, it should not use it. If a tool is expected to communicate just with explicitly specified hosts, it should not communicate with third-parties, ...