I find our standards and norms around network access to be unacceptable. Programs shouldn’t access the Internet without opt in by the user either as a setting or a UI interaction.

We had many years of applications from the dial up error and prior that didn’t assume constant connectivity and we all survived.

Even an OS enforced blend of oauth style initial permission and LittleSnitch where the user is asked what they consent to at first launch would be fine.