Yep, and from my experience too (made a tool that monitors network traffic with eBPF [1]) in addition to those issues there is also a sizable latency hit.

[1] https://github.com/elesiuta/picosnitch