If you mark a derivation as impure with __impure=true; and activate "ca-derivations flakes nix-command" as experimental features, you can access the internet.

I agree sometimes is a pain tho.

But most of the time, If you need internet access, if you can specify the "hash" of the result file, anything that you do to achieve that file can have internet access.