It's not the first time Apple allowed certain applications bypass the firewall / VPN (see https://www.macworld.co.uk/news/apples-own-programs-bypass-f... ).
It is very bad indeed; not even Microsoft dares to do this in Windows (you can still very much block any network request from any part of the system via firewalls or DNS ad-blockers).