That'll work while they continue to use dedicated hosts (eg, telemetry.microsoft.com) to collect the exfiltrated data. With a single update they can shift that collection stream to another host (windowsupdate.microsoft.com, or a skype host, etc) such that blocking it would break other stuff