This would certainly be news to me as well. Packet capture (even local) has historically required superuser perms, but I'm not up to speed on how MacOS permissions work in this regard since the launch of System/Network Extensions.

After writing the above, I've just reviewed [0] - as much as I could in 5 minutes - and as far as I can tell it confirms our understanding. To do packet filtering or interception or reading, you'd need to do [1].

[0]: https://developer.apple.com/documentation/technotes/tn3179-u...

[1]: https://developer.apple.com/documentation/NetworkExtension/c...