Life is unkind, and forces me to admit more oversights in the network monitor portal code.
Looking at https://github.com/flatpak/xdg-desktop-portal/issues/208 I realized that the current portal code always returns FALSE for can_reach(). I have another version of the portal interface here that adds a CanReach method: https://github.com/matthiasclasen/xdg-desktop-portal/tree/network-monitor-again
This branch makes use of that new method. It also replaces the controversial 3 roundtrips with a single GetStatus call.