>https://sneak.berlin/20201112/your-computer-isnt-yours/
>
Al, from the article:
"@patrickwardle lets us know that trustd, the daemon responsible for these requests, is in the new ContentFilterExclusionList in macOS 11, which means it can’t be blocked by any user-controlled firewall or VPN. In his screenshot, it also shows that CommCenter (used for making phone calls from your Mac) and Maps will also leak past your firewall/VPN, potentially compromising your voice traffic and future/planned location information."

I guess that is intended to mean firewall or VPN on the Apple itself - can't see how a firewall at router or other machine would be compromized by Apple HW going through it (pls correct if wrong, as networking not my forte!).
Extrapolating from that, at least any VM running on a traditional, OS based host system could be filtered by the host OS ? Seems MacOS will not barf totally on trying to install as guest OS early on, as per:

https://www.howtogeek.com/289594/how-to-install-macos-sierra-in-virtualbox-on-windows-10/
https://www.hackint0sh.org/how-to-install-macos-on-virtualbox/

Probability of buying one of the new ARM based machines just multiplied by 0.01, as control of host OS might be not given to owner - probably Apple thinks HW is only on lease :-((

sad state of things...