Simple: most router firewalls only block traffic that has source:<IP of device> and destination:<anything in the Internet>, but traffic from source:<IP of device> to destination:<IP of router, IP range of home network> will be allowed.

That is enough for the device to emit a DNS query like "pbs.12345.metricservice.example.com" to notfiy some tracking service that the device with serial 12345 just switched to a channel labeled "PBS". The router will resolve that name record at the DNS server for metricservice.example.com, which gets the request and logs it away.

Are you suggesting that devices connected to a network that has blocked their MAC can still make DNS requests?

How many consumer routers go that length? For most of these, as long as they are on the network, they can communicate over DNS, using the router as "middleman".