That is certainly true. Though were I really concerned, I could assign my firewall the entire block, filter traffic, and filter traffic on a given address to a given device. That aside, I trust myself to configure a deny rule and just let through what I need.