Why not also provide a way to deny all network access to the app? Then there’s nothing it can do with any data of gets.

This is how third party keyboards work on iOS. No network access by default, but the user can go into settings and grant network permission if they judge it fit to.

I think this model would make a lot of sense for Android launchers, too, given how they continually run and potentially have access to much more user data than is typical.