> By design Android/iOS does not enable users to deny internet access to specific apps.

It does seem like the number one permission you might wish to choose not to grant, doesn't it?

In a privacy-first design there could also be an API for an encrypted channel that the user has access to, rather than allowing the device to send mysterious black-box data from your device on your behalf in the background whenever it wants. Though I suppose it would just turn into base64 "plaintext" payloads quickly and become normalised rather than a neon sign of fuckery afoot.