It seems that the firewall, while enforcing the blocks for an application, fails to do some sort of a reasonable parent-child-watch. A game itself maybe stopped from going out to the web, but if a small child clicks/taps a "do you want more sheep" or something like it, the application is not blocked from going out through the browser.
Tell me I'm wrong.
Using beta on Thrive.