But basic internet permission is given to all apps without asking.

But it really shouldn’t be! And GrapheneOS, at least, always asks the user when installing apps that want network permission. If the user doesn’t plan on using any network-based features of the app, they can simply decline.