I agree that it would be nice to separate the privileges if it were possible.
I suspect that allowing internet access even in the form of ads opens the possibility for data exfiltration in principle. But I'm not familiar with the Android case at all.
It allows for expensive, obvious data exfiltration. (Expensive in the sense that somebody else could take the data, unless you're the highest bidder for those categories – assuming Google Ads still shows ads with a bid of 0, which I'm not confident in.)
I suspect that allowing internet access even in the form of ads opens the possibility for data exfiltration in principle. But I'm not familiar with the Android case at all.