Because you don't know what conditions would trigger a circumvention of the network extension. There might be a zero-day somewhere in macOS that allows a malici

Because you don't know what conditions would trigger a circumvention of the network extension. There might be a zero-day somewhere in macOS that allows a malicious app to circumvent network extensions. If you look for leaks, and don't find any, it doesn't mean there aren't any.