Such devices should be retuned for a full refund. Vote with your wallet.

My devices that do this were bought off aliexpress for about a quarter the price of a reputable brand. They do function and I purchased them expecting I would have to do some finagleing to get them to work and not phone home.

Then they can exfiltrate data over DNS.

I mean, only if the DNS server is one run by the company in question.

I own nonzero such devices that hit 8.8.8.8 as an internet access sanity check so I have to keep just that IP allowed for them and block all other traffic.

DNS is a hierarchical protocol. You can exfiltrate data as long as the DNS server is resolving recursively.

Good to know. I didn't know that.

For my devices in question I can see the size and frequency of the requests in OpenWRT and doubt it's actually doing so.

Then give it a DNS server to look up.

Yes exactly.

All I meant was that sometimes if you fully block a device it refuses to work, and you may need to selectively unblock just 8.8.8.8 for that device.

Obviously buying such a device is bad, but sometimes you get one for free or close to it and it's worth the hassle to not pay hundreds for a better one.