You block inbound to block inbound. Of course it doesn’t do anything for outbound. Acting like you can just turn inbound filtering off because of that is disingenuous.

Nobody suggested "just turn inbound filtering off"?? We're talking about an alternate universe of program design.

And we're talking about malware in general, not inbound or outbound specifically.