It might be able to report that unfiltered traffic occurred, assuming it can detect unfiltered traffic using pcap, but it wouldn't be readily possible to preven

It might be able to report that unfiltered traffic occurred, assuming it can detect unfiltered traffic using pcap, but it wouldn't be readily possible to prevent the initial packet from being sent prior to a rule specifically being created to prohibit it. Operating a system in PF deny-all default would cure this, as long as LS carefully curated a list of PF allows. It's possible there are external constraints preventing more widespread use of PF, like "Is this allowed on Mac App Store?".