if a device manufacturer is so hell bent on their devices phoning home that they'll connect to an insecure wifi or a wifi network run by a 'partner' provider.. they're gonna be doing that whenever it can't phone home via a configured network connection, too, and not just when there isn't one set up.

It doesn't prevent exactly what my comment said it doesn't prevent 'an adversarial entity physically residing within the space'. If I showed up with a pi bristling with antennas, loaded with an unknown, encrypted payload, and plopped it into your living room, would you just hook it into a vlan and be like "there, now I'm safe"?