I believe that permission is currently "leaky". The app can't access the network but it can use Google Play services to display ads.

I believe that would theoretically allow exfiltration of data but I don't understand all of the details behind this behavior and how far it goes.