It's automatically granted but the app needs to declare it in order to access internet. Because of that it's not enough that the app _currently_ doesn't request internet permissions, because if it ever starts, it would be mostly transparent to a user

Yes. Without the permission all network requests will just fail.

You can silently add the permission in an update though. It's safe if you don't auto-update it I guess.