I partially agree but isn't the port blocking mostly about reducing the attack surface? If I were managing infrastructure (I never did), just trusting a browser

I partially agree but isn't the port blocking mostly about reducing the attack surface? If I were managing infrastructure (I never did), just trusting a browser and its security model sounds better than following bunch of white-listed apps for zero-days.