On a single site WP-CLI knows which site it is. On multisite it does not, so every command runs against the network’s main site unless told otherwise — and a plugin activation or an option update lands somewhere surprising.
wp option get blogname --url=shop.example.com
wp site list --field=url | xargs -n1 -I{} wp plugin update --all --url={}The second form is the one worth keeping: iterate the sites and run the command per site, rather than assuming --network covers it. --network exists for genuinely network-wide operations and quietly does nothing for commands that have no network equivalent. On a single site the flag is accepted and ignored, so it is harmless to leave in a shared script.