It’s really nice to have ad and tracker domains blocked systemwide though I think you need to be more careful and set your device up as supervised to have more robust blocking (real always-on VPN functionality vs. best effort?).

And even then when I read about defects in Apple software that means a firewall like Little Snitch isn’t perfect (macOS) I think an external device (mobile VPN router?) is going to be essential for some threat models.

(& uMatrix looks great!)