"There is no way to deny internet access to a specific app that supposedly ‘needs’ it."
There is a way, which I employ to great success: don't install the app.
The SD card is a real worry, but I thought that apps are Sandboxed in a way - they might only see the files they created themselves? I would have to check - otherwise it would of course be completely broken.
No, unless i am mistaken they are not sandboxed with respect to the SD card, and apps with write permission (comes for free with API 1.4) can also modify or delete any SD card content - to install a windows virus for example.
There is a way, which I employ to great success: don't install the app.
The SD card is a real worry, but I thought that apps are Sandboxed in a way - they might only see the files they created themselves? I would have to check - otherwise it would of course be completely broken.