That is a problem with some of these tests being done. Disabling components that are designed to work in tandem and disabling the internet basically doing the same thing, provide inaccurate testing.
There should be indeed payload downloads from those files but from what I can see and read, there's no internet so we can't fully confirm those would have been blocked. Anyways, nice heuristics from Norton. SONAR has always shined amongs other behaviour blockers