I'm not sure what that means or how the second statement follows. You can't firewall the kernel from making network socket calls either, because the kernel is what implements the firewall. Of course the service manager is going to have higher privileges than every other process on the system, because it has to supervise all the other processes.

Can you expand on this? Systemd doesn't make network calls, so presumably you mean services started by systemd, which there exists an API specifically so you can do things like start a firewall before the network is brought up.