A rootkit typically patches the kernel or other software libraries to alter the behavior of the operating system. Once this is happening, you cannot trust anything that the operating system tells you.
For example; a simple change to the
dir program could hide the existence of malicious files from a user, but this is easily detectable by many anti-virus packages as the alteration of an executable is something that can be noticed. If however, the malware alters the mechanisms by which userland programs query the file system, by patching the kernel itself, any user-space program can be tricked into thinking that the executable has not been altered.
Once malware has started altering the behavior of the system calls/kernel api, it can hide any activity effectively, including network interactions.
All of this only applies if you are monitoring the infected machine locally. If you have firewall logs or some other remote method of monitoring the infected machine, this information can be trusted (the network connections still have to exist, but they can be hidden from the infected OS).