Maybe treating any ad network component as a "sub-app" with separate permissions would make it more obvious when a request for network access is unwarranted. As to how something like that might be implemented... I have no idea.

I suspect people would ignore it anyway.