Well it's kind of possible to block it with routing tables+rules only, but you're right. This is also painful if iptables/nftables binaries are not installed.