GrapheneOS.

So, yes, you're right. But I don't fuck around with stock shit.

I'm using firewall features from RethinkDNS to block internet connections per app. Still using Nova Launcher v7.0.58 with auto update disabled.

You could use netguard, tracker control or rethinkdns for this. Surely there are other apps as well.

I didn't even know google gave this option, been using netguard since 2017.

You can deny network permission in any Android builds, without root it can be done via a mock VPN client so that all traffic is directed through an app who can block or control traffic per app. And on devices with root this can be done via iptable configurations.

There are multiple apps for doing both approaches.

Especially why wouldn't you have root anyway, in this day and age if you don't have root, well may Google has mercy on you LMAO (hint: they won't lol)

I don't think you even can deny apps network permission on most Android builds anymore. Didn't Google kill that option years ago for the sake of ads?

The solution to this is rooting your phone. Root allows you to get around those arbitrary blocks.

You can also force-deny network access via root; you don't necessairly need GrapheneOS and a Pixel.

(Why is everyone using GOS? You can achieve the same amount of privacy with rooting and using apps that respect your privacy, and contain the ones that don't. Also, you can do cool stuff with a rooted device.)