I agree that malware means game over. But firewall rules at least protect against wimpy malware.

And yes, I really don't know why they haven't embraced Whonix.

What's funny is that Tails has more visibility, and it's actually less effective against malware. Because there's no isolation between userland and the Tor client.