An app cannot reach the internet, because it has no word for it.
Apps run with one binding in scope. There is no fetch to forbid, no filesystem to lock down and no database handle to scope, because none of them are in the object an app receives.
We wrote a deliberately hostile app and threw thirty-six attacks at it — network, filesystem, code generation, other tenants, escalation, an infinite loop. None got through, and the suite runs on every commit.
Reaching anything outside happens through a connector, which holds the credentials and can only reach the one host its specification derives. An app asks for “send mail”; whether that is Gmail or Outlook is your business, not the app’s.