Firewalls like Little Snitch may not be enough against actors like NSO (that exploit unknown zero-days), tbh. The mechanisms to enhance protection does need to come from the vendor (Apple). This lockdown mode, for all its present shortcomings, is moving the needle in the right direction, imo.

with something like little snitch, you could just prevent or tune internet access on an app-by-app basis. including system apps.

Apple - in a self-serving way - does not provide good permission for network access.

I think it should say "allow this app to access the internet?"

There is also deep linking, the ibeacon stuff, the find my, the wifi access point mapping, and more