Taking a quick look MAPS block at first sight, it appears to look at both the executable file and non-portable executable files such as JS, VBS, or macros, then stop execution, however it isn't clear if this also includes things such as dll files or the python script being executed by python.exe.

The firewall feature of GlassWire, or any application level firewall will only block traffic for your typical, well behaved programs, to save some bandwidth, and possibly block some telemetry if the program isn't too mischievous. This is because GlassWire doesn't stop the program, and can't tell if you're the one running the executable or another application is running it programmatically, so if EvilApp.exe notices it can't connect to the internet, it could just use something innocent you've allowed such as Firefox or python to send/receive data on its behalf (or just do that from the start).

This is why it's still important to check the bandwidth of programs you trust for abnormalities, even if you've only allowed trusted programs and block everything else, and why it's so important to keep programs up to date and only run stuff you don't fully trust in a sandbox (since I doubt MAPS block on first sight is perfect either).