> Oh and another thing a lot of people don't know: The OS stores Wifi passwords in EFI boot variables. This is used for Internet Recovery. So if your device is stolen or just lent to someone else, consider your Wifi passwords compromised, regardless if the disk was encrypted.

I can't speak for if this is true or not, but I literally yesterday ran Internet Recovery and it didn't remember my wifi password. I had to re-enter it myself.

Little Snitch is a good reverse-firewall which might be preferable to messing around with /etc/hosts for many, especially since it offers active protection.