Just blocking access to internet for this one app is not enough. It can use intents or a shared local storage with some other app to send the data out.
yes that and internet permission can be added later and pushed with an update. Unless you are checking permissions after every update you will not know.
ADs work via play services so even if you block internet for the app the ADs will continue to work.
The reason many apps stop showing ADs when their internet is blocked is because they need to make an API call to their own servers before running the AD. That is the common behavior but not mandatory
Lacking INTERNET permission today does not guarantee that the app will never have that permission. The internet permission is considered a "normal" permission by android so it will be auto granted without even a notification to the user.
Moreover an app without internet permission can still send data out using "INTENTS" for other apps in Android. This can make an app dangerous even without internet permission.
I was excited about the application and was dissapointed to see that it was closed source. I will absolutely not trust anyone that I cannot sue with this data. Big companies at least follow some standards that are enforced by multiple governments here we know nothing.