One example is embedded IE/Edge views. It seems that those are a process of its own (sometimes), likely out-of-process COM instances. But if you want to allow one program to access the network that way but not another one, well there is (to my knowledge, and I haven't really looked into this) no way to do that. Same for the 'background download' service, the search service mentioned in the OP (although that's only used internally by Windows afaik, but by several sub-components), etc.
Not to mention, there isn't a whole lot of software left that doesn't need at least some networking for its 'primary' functionality. Whether that's by design I don't know. I blame engineers and marketing/product people equally for not showing enough restraint (i.e. the trope of 'just because they could... asked if they should...' etc). But nobody cares about my opinion on this, and the majority of users don't realize or care - and even if they do, they're as powerless as I am, individually.