> Trying to block things in this way ends up being a whack-a-mole situation, and you're also suck monitoring it forever as the vendor deploys things to bypass any blocks, or adds/changes things.
Just a note, for the linked item I haven't change anything in 2 years and it's still working fine.
That's because it's an allow list, nothing gets through unless it's specifically towards netflix domains and addresses.
It's much easier to manage then the reverse as you noted.
Sure, it could be defeated with effort but it would be visible (updates available or ads or similar), and at that point you start investigating.
It also requires some initial effort to set up if you want anything else from the TV (say youtube or amazon prime and so on)