> easily it's a lot more difficult/leaky, for example it's not possible to block a certain app from accessing the internet; Sure, you can gather all the domai

> easily it's a lot more difficult/leaky, for example it's not possible to block a certain app from accessing the internet; Sure, you can gather all the domains it connects to and block those, but those domains and/or ip addresses can change over time. And when they do, you will not notice, and the app will be able to access the internet until maybe one day you notice and start blocking the new domains/ip addresses.