Some services need to use software components with a higher risk profile or with a history of security problems (e.g. in media-processing libs like ffmpeg or libtiff).
We should create iptables profiles to restrict outgoing traffic and report potential violations. This can obviously be circumvented by attackers which manage to escalate their privileges to root, but it's a useful countermeasure against an attacker exploiting a vulnerability in an unprivileged service and attacking further systems from that host.