Some years ago, when Google introduced the permission system with Android Marshmallow, I watched this developer conference presentation. At the end of it, a visitor asked whether there’s also a permission to prevent internet access.
The Google guy who had presented it, responded that there was not, because with the other permissions in place, no app would have access to data that shouldn’t be on the internet.
I’d wager every single person in that room was techy enough to know that this was complete horseshit, including the presenter, but that did not stop him from pressing it out his grinning teeth.
To this day, when you install a third-party keyboard app, you either trust it with all your passwords and everything you type + internet access, or you don’t use one, even though 99% of third-party keyboards don’t need internet.
Similarly, you could allow camera apps etc. to not need to ask for permission, if they don’t use the internet, thereby reducing user fatigue.
Instead, Google decided to compromise security of the Android platform, I imagine, because they want apps to ship with (their) ads and trackers.