That’s why half of the servers are now specified using the IP address, and half is still specified using the domain name.
That is, if your firewall blocks the IP addresses it should only take (on average) one retry per update to get to the server.
AFAIK avast tries for 10 times (10 retries) so it should work OK.
BTW the reason we replaced some of the domain names with IP addresses is to not be dependent on the local HOSTS file (and its possible hijacks).