you could, but this is not good enough. A malicious app can collect data to send, store it, and wait until you slip up and accidentally give it internet access

you could, but this is not good enough. A malicious app can collect data to send, store it, and wait until you slip up and accidentally give it internet access. Again, this is trivial stuff, no elite hacking required.