Yes, it does. It requires that the drone be internet connected or, with almost exactly the same risk/hassle profile, that the base station within 400ft of the drone be internet connected. That's a crazy requirement, and a crazy extra risk.
There has to be a base station somewhere, unless the drone is fully autonomous and not even indirectly controlled by anyone, which appears to be in violation of other regulations anyway. If the drone is capable of broadcasting directly (“standard remote identification”), then that base station doesn’t have to be within 400ft; it must have the capability to connect to the internet, but the drone can operate even if it’s out of service.
That could add some cost. However, AFAIK (not an expert), the most popular drones are already designed to be connected to a phone – either directly (for short-range amateur models) or with a controller that you attach your phone to. Those devices could presumably use the phone‘s internet connection, so there would be no added cost, although I guess the phone would go from optional to mandatory(?).
I don’t know what you mean by “risk”. Risk of the base station being hacked over the internet? It’s a possibility, but it doesn’t seem like the end of the world, especially since the base station would only need to make outbound connections to specific servers.
The internet connection is only required if the drone is incapable of broadcasting its own local ID signal. This will not be a problem for the kinds of drones that have practical uses in remote areas.
Also, as with many other drone regulations, this does not apply to lightweight units.
From a quick skim of the unpublished document it seems like a compliant transmitter could be built from hobbyist parts for under $100 and weighing a few ounces. Commercial options should have no trouble beating both of those numbers.
It seems like those with drones at the absolute bottom end of the "registration required" range could be limited by this but as long as your drone could handle having a basic flip phone attached to it you shouldn't have trouble with this.
You're raising valid points generally but read 89.110 for Standard Remote Identification. If internet is not available the drone must broadcast the information elements directly. This does preclude 'limited remote identification' UAS from operating without any local internet and of course no remote identification UASes will be stuck in the FAA sandboxes.
Definitely some rough edges in this that will hopefully get eviscerated in public comments.
When I fly, the "base station" is the controller in my hands. It has no greater or lesser ability to be internet connected than the bird itself. No phone is involved in the operation of any of my machines.