" Under no circumstances should anything be accessing the internet these days without a list of defenses as long as my leg."
Yes; for sure. But the trouble is, that's not what happens. Everyone is obsessed with capturing metadata that can be analysed and then (most importantly) used to make MONEY. Even some FOSS / OSS has been modified (in some cases without people knowing) specifically to make it easier to capture / monitor data.
The worst are the apps that continue to run in the background after being closed, and capture data from other apps or web browsing. Normally, the developer company are adamant that "they" would never abuse what they find, but are the first ones to get upset if someone else does the same thing, and messes up what their lovely app does.