Yeah, I was actually aware of that, while writing the above. The AndroidManifest.xml is zipped into the APK-file, so even for closed-source apps, you should be able to check it.
Problem is, of course, that it doesn’t help less techy folks, but also that you can’t prevent app updates from suddenly adding internet access.
And that you can’t take it away from apps that do claim to need it. At some point, I had some sort of root/XPosed/whatever setup, where I could take this permission away from apps, but because this was a thing that couldn’t happen normally, they all just flopped over sideways, saying things like “Please connect to WiFi 🥺”.