I wonder if little snitch gets access to _all_ traffic. I remember several osx releases ago there was an issue because osx (big sur) moved to an api interface and it broke little snitch. I assume if apple was dedicated enough they could block some traffic from being seen by little snitch.