No claims that it is sufficient - what is does do it prevent any non-trusted file based executable etc from running.

Doesn't do fileless, memory-based or rootkit but does prevent any untrusted and therefore unknown executable from running.

Does that have value - of course, a true default deny approach.