A bit into tinfoilhat territory but just because they don't advertise that they have an 802.11 radio doesn't mean the devices can't have one. Or an LTE/4G/5G radio.

If the user data is worth that much then I wouldn't be surprised if some manufacturers put such radios in their non-smart TVs in order to try and gather such data.

I live in a densely populated part of a large UK city and (checks `nmcli dev wifi list`) there are 14 distinct wireless networks near me that aren't mine. There's a good chance that any IOT device could find something nearby, and there's even a whole load of LoRa nodes that it could use for a very slow uplink.