After feedback from aforementioned firewall developers, changes were made to network extensions that allowed them to do what they wanted with their applications

After feedback from aforementioned firewall developers, changes were made to network extensions that allowed them to do what they wanted with their applications (for the most part, at least). I still think that it’s a worse in-practice system than kexts but they are responding to feedback at least. You can still load kernel extensions in Big Sur by disabling SIP, though.