There are about 30 Apple processes to which you need to deny all network access. Then a Mac is relatively quiet. (By default Apple stuff is whitelisted in Little Snitch, you have to go and manually uncheck built-in allow rules.)
Apple built something called the ContentFilterExclusionList that bypassed Little Snitch and VPNs for Apple apps, which was thankfully disabled rapidly (and without an announcement) after a big backlash. Hopefully it will not resurface.
If it does it will still be possible to alter the system boot security level setting and tamper with the signed system volume (and modify the exclusion plist) and the system will still work (and so will the firewall), but it will take some hacking. This (and the work by marcan and the Asahi team) is the sole reason why I just dropped eight large on that chonky mac mini with the twenty cores.
The escape hatch remains. For now. (You still can't buy them anonymously.)