I don't get how it works, or works well -- presumably those domains are behind CDNs, and IP addresses are unpredictable. So the firewall allows traffic to specific IPs that are resolved at the time the script is run, but not after that? What if the same domain is resolved again without going through the cache, and it becomes a different IP?

And even if that works, this is a very short list. As soon as you reach for Go, Rust tooling etc nothing works. So you need to manually maintain this list which is nothing but painful trial and error.