GrapheneOS, at least, does make Internet access a permission you can turn off. It even goes one step further in that you can turn it off at install time. This i

GrapheneOS, at least, does make Internet access a permission you can turn off. It even goes one step further in that you can turn it off at install time. This is something that should be in stock Android. For devices which don't have GrapheneOS installed but can be rooted, a firewall like AFWall+ is an option. It's not entirely as secure as just not granting the permission in the first place (I know of at least one way to bypass AFWall+, if an app is prepared for it), but it's still a good option.