I think the main gripe is Google's lack of API to access a firewall. It would make sense for the kernel to provide that API and leave the UI to user space apps.

Edit: and to clarify, you can have a user space app on Android to configure a firewall but they will either require root or a VPN-based solution like NetGuard.

Both SELinux and AppArmor support per app network rules, however they both leave something to be desired in terms of ease of use and features.

https://selinuxproject.org/page/NetworkStatements

https://manpages.ubuntu.com/manpages/bionic/en/man5/apparmor...