Well, it would still need another app to do the “phoning home” for it, right? If both apps voluntarily work together they don’t need to run as the same user/dev key. One could simply open a local socket which the other talks to or use a myriad of other mechanisms through which apps can communicate with each other.
But that means if you trust all the apps that CAN do internet connections, then you don’t need to worry too hard about the ones who cannot. They could still collect all sorts of data about you but they cannot “call home” without a messenger.
For most google apps “google play services” is this one-fits-all messenger, and most google apps/services won’t work anymore if you uninstall google play services.
One problem that I ran into is system services that are not apps. As such, they can not be uninstalled or disabled, since they are device drivers. But they still can access the internet (in fact you can’t deny it since the access restrictions policies only apply to apps, not to operating beneath that layer)
Google apps rarely sink “that low” (scnr) - but unfortunately Qualcomm does, as I have documented here.