Thanks Asyn,
Only option I have there is "trusted", and it's been on that setting all along.
I'm starting to get the bad feeling that the Avast One client doesn't support configuring individual ports... That would be bad. I have confirmed that when I shut the firewall off the Sonos app works fine.