Yes. Default deny application firewalls are really powerful tool. It really can take the wind out of large classes of exploits. They can't phone home to exfil data or get follow up command.

It isn't something I'd recommend for everyone, because it is a lot of work and faffing around, but be extremely effective if you are willing to invest in managing it correctly.

Little snitch, the macos equivalent to this was the recommended way to stop pirated copies of Adobe CS programs phoning home for years. Don't think that's the kind of issue you meant, but it does solve it.

Researching every connection is painstaking at first across various operating systems but a tool like this really helps you get familiar with what is normal and what is not.