Do you mean a no-internet app (like this) could write data locally in a way that another internet-enabled app (in cahoots) could locally receive? Like a non-sandboxed storage area? Seems plausible.

Meta literally got caught doing this.

Writing to a local server, and then uploading from the browser to bypass consent mechanisms.

https://wire.com/en/blog/metas-stealth-tracking-another-eu-w...

yes that and internet permission can be added later and pushed with an update. Unless you are checking permissions after every update you will not know.