This is completely wrong. Malicious software has a long history of detecting monitoring so it can avoid detection. A closed-source browser with backdoors can d

This is completely wrong. Malicious software has a long history of detecting monitoring so it can avoid detection. A closed-source browser with backdoors can detect Wireshark, Little Snitch, or whatever you're using to detect outgoing connections, and not connect while those programs are running. The problem is even more insidious when you're making regular expected connections to a site that the browser creator controls. Many (most?) Orion users are already connecting to Kagi on a regular basis, so they can simply wait until the user logs in to Kagi and smuggle out the data they've collected along with the login request. In the most extreme case, the browser can not exfiltrate any data at all unless triggered to do so. In this case, the attacker targets specific victims to exfiltrate data from, but avoids exfiltrating from any security researchers or knowledgeable users who might be running software to detect the exfiltration. In short, the goal here is for those of us with more knowledge to be able to verify the software for every user, because not everyone is capable of monitoring their outgoing traffic effectively, and it's far too easy for backdoored software to simply not phone home when it's being monitored.