Theoretically LS could tell you if some malware was connecting to, say, a strange IP address, which wouldn't ever hit DNS.

Obviously a smart/sophisticated Russian hacker wouldn't be connecting directly to a Russian IP, rather using a local-to-you cloud server as an intermediary, but still.

I think LS is more oriented toward someone who wants disclosure, as opposed to someone who wants specifically to minimize telemetry and trusts a blocklist to do a good enough job.