While not disagreeing with you, Android does have an Internet permission in the manifest. For an application to use network access, it must define both:
So if a keyboard is open source, one could quickly validate if the keyboard app actually is requesting to have Internet access or not, and one could choose a keyboard based on it not using these permissions.