I don’t think it’s a loophole. If you will check Network Connections in the Firewall, you will see Avast has a constant established connection with Google. How else would Google show up on the test?

That connection is AvastUI.exe