The Internet permission was largely useless. If you knew what you were doing, it was trivial to bypass it to exfiltrate data. On top of that, almost every app requests it, which contributed to alarm fatigue in users.
Permissions are only useful if they can be enforced and users pay attention to them.
For relatively small bits of info, probably only once before the app is uninstalled: yep, agreed, this works. There's no practical way to prevent it either, short of requiring interaction literally all the time, which just makes dialog-fatigue worse.
But ultimately this will do a single extremely visible GET request, which is limited by the browser's normal sandboxing. That's quite far from "bypassing the internet permission". And in some cases ineffective (e.g. I have multiple browsers and intentionally do not set a default), though that's rare enough that I don't think it's relevant.
---
An "app can send intents" permission would be sorta nice for things I truly want sandboxed, e.g. a password manager. XPrivacy allow(ed|s) blocking stuff like this, I would and did happily toggle it off for most apps since e.g. many games have no need of anything but their APK's data.
Permissions are only useful if they can be enforced and users pay attention to them.