Something being open source doesn't automatically make it safe to use. Sure, it means it's easier for people to check for security issues, but how many people actually have the knowledge and the time to do it? And even then, take the log4j vulnerability from a while ago, it's been present in the code since 2013 and only reported in like 2021.

You still need to build package and install it yourself though or else you are trusting someone else. Open Source software has been used as a vector for attacks before by bad actors getting access to the build system or source code.

I try to where I can, but unfortunately this is not always an option for me.

You mean like Wireshark lol?

If you're just interested in connections (and don't care about packet inspection) you can use Little Snitch (paid) or LuLu (FOSS).

Actually, all the Objective-See Foundation security tools are great and target specific classes of vulnerabilities, like LuLu for outgoing network connections, RansomWhere for detecting ransomwear by looking for encryption events, Oversight that monitors you cameras and microphones and a bunch of other really small, but really useful security utilities. Better than running a shady antivirus that's going to suck up loads of resources and rely on signatures.

PiHole on a Raspberry Pi

Wireshark is available on intel and arm macs.

But various forms of backstabbing are legal as long as you let your users know that the TOS have changed. I mean, who reads that stuff anyway. You can literally throw in there whatever you like and people will just click “I agree” regardless.

The macOS firewall can only block incoming connections. If you want to block outgoing too you need something like LittleSnitch or LuLu.

It does. Didn't think of that actually.