I wont re-explain since someone already gave a detailed explanation but if you’re interested in having more control over your apps and their access to internet but don’t want to pay for safing’s subscription you can also use SimpleWall from Henry++, has a nice zero-trust by default and you get used to it eventually.
+1 To AuthPro, the guy behind the app is really cool