I don't see why half the shit in that list would be needed during a recovery process, let alone need to bypass a VPN as well. If Apple wants to claim this as their defense, let them. Until then, I see little value in dreaming up excuses they aren't willing to make for themselves.

They already have a "system recovery mode" where no such firewalls run, and only select system tools are available. There's also "safe mode".

That could really make sense of why you need a config file and it is just a simple bug at the same time.