So it's a sort of hardware-based Little Snitch without the ability to block connections. Neat. Perhaps a useful tool for the security-minded but not a true safeguard. Remote code execution exploits are very real. All an attacker needs to do is modify your network configuration (DNS, proxy, hosts file, etc.) to disguise network traffic over a specific address that looks real enough so as to not warrant suspicion. This exploit could also be designed to sit idly while the device is in airplane mode, avoiding the case's primary detection feature.