I‘d argue that not allowing your servers to make outgoing calls to non whitelisted targets is very basic security.

No, it's not. I can easily configure open ports using firewall-cmd. That is basic security. And there's no dedicated options to configure outgoing calls, there's no sane defaults to start with (I have no idea which targets should be whitelisted: ntp? update servers? anything else?), there's no system-wide integration, like my dnf can choose different mirror every time it runs.

Of course it makes sense to configure outbound white list, but there's no infrastructure in RHEL or Ubuntu and nobody's going to bother with custom scripts for that.

Are we still talking about the bug that relies on poorly chosen defaults?

Do you disable DNS on your servers as well or use a restricted internal-only resolver?