They should, but they often aren't. Also, even if they are, this can be exploited with a port number the attacker picks. So unless you specifically whitelisted

They should, but they often aren't. Also, even if they are, this can be exploited with a port number the attacker picks. So unless you specifically whitelisted what outbound hosts your machine can reach and only those (which is rarely done and not always possible), it isn't likely to help.