Comment by jeroenhd

Android itself doesn't enforce it, but starting with Android 9, you have to opt in to HTTP requests rather than opt out. Most app developers don't even know about this so their applications (and the ads packaged within) cannot do plaintext HTTP calls using the normal system API.

Still doesn't prevent an ad library from bundling libcurl and doing HTTP calls manually, of course, but it's a sane default.