It seems that the firewall, while enforcing the blocks for an application, fails to do some sort of a reasonable parent-child-watch. A game itself maybe stopped from going out to the web, but if a small child clicks/taps a “do you want more sheep” or something like it, the application is not blocked from going out through the browser.
hello the block is enforced on linux UIDs. As the browser on Android is a separate tool that just gets “invoked” from the game there is a new UID. So you would also have to block the browser. Sorry but there is no other way to do this (as the browser is not EMBEDDED into the app but independent).