I am surprised to see the website saying: Sandboxes don't have network access, so if a malicious document can compromise one, it can't phone home With a combo

I am surprised to see the website saying: Sandboxes don't have network access, so if a malicious document can compromise one, it can't phone home With a combo CSS, HTML, JS it is networkable from localhost.