If you don’t trust your kernel I don’t think some dinky application-layer firewall is going to save you.

How is this bad? They are likely sending a SHA-256 hash of the binary, not anything the binary itself to compare it to a bloom filter of known exploits. I'd expect any decent OS malware protection to be doing that.

I tried installing little snitch on catalina and it needed a network connection exactly for that.

I would like to know how to disable this and install little snitch. Maybe spctl or csrutil?

Little Snitch is good but what happens if the kernel can’t get a binary approved to run??

And people complained about Windows 10 telemetry.

Last time I run macOS. Time to return to Linux (Pop OS I think)