There are lots of ways. Think of it from an anti-malware perspective: how can the botnet agent on my PC, which has OS-level privileges, discover and communicate

There are lots of ways. Think of it from an anti-malware perspective: how can the botnet agent on my PC, which has OS-level privileges, discover and communicate with the daily command-and-control server, if each day the network admin blocks the previous day's CnC server IP address? Any network communications that the OS is allowed (or that a Microsoft program or driver that the OS trusts is allowed) can be used to carry extra data about which IPs to talk to in order to exfiltrate "telemetry" or download updates. DNS and WHOIS queries (where MS can publish arbitrary queryable records), peer to peer DHT-like networks (ditto), Tor (designed not to let your router/firewall know who the OS it talking to), the list is endless.