Laptop users who want broad Internet access (and will complain loudly if reddit/HN/Twitter is "down") aren't the same thing as the app server that only talks to a short whitelisted set of RFC1918 IPs, on specific ports only, and doesn't have Internet access - not even DNS. (WannaCry demonstrated why not.)

Reddit and the like needs to accept they are hosting botnet C&C servers due to hosting loads of user-generated content (I'd do an invite-only subreddit with a tracking pixel in the CSS), but that doesn't make it pointless for the rest of us to do something where possible.