At least in theory you can sandbox an app so that it does not have (unlimited) access to the network.
At least in theory you can sandbox an app so that it does not have (unlimited) access to the network.