I thought airlines still had to file passenger manifests with CBP separately, no?

Yes, though that's separate from the flight plan.

There's also several different ways to transmit the passenger manifest to CBP - including over a CBP-provided VPN and IATA "Type B" messages sent through ARINC/SITA.

The network for Type B messages is also independent of the Internet (it was developed 60 years ago).