Excellent point on allow listing. I feel like I'm moving further and further in that direction - primarily due to the block lists becoming un-manageable in their size / memory needs.

OPNSense is beautifully flexible for this.