Counterpoint: I did the same thing and used Little Snitch to try to catch a request, and did not see one. If there had been one, it would have attributed it to a particular process.
1. When Apple first switched from kexts to the network framework for apps like LittleSnitch, they exempted a ton of their own system processes (things like the App Store, and iCloud) from flowing through that framework. This change was reverted shortly after (I believe even before the GA release of that version, but don't quote me on that)
2. LittleSnitch ships with a bunch of default Allow rules designed to let expected first-party things like the App Store and iCloud work. I assume this is done so that the user experience for new LS users isn't "install app, entire system comes grinding to a halt". But these rules can be disabled by the user.
That's what I thought but on checking, it seems they've been stripped back to a bunch of Apple domains rather than blanket permissions for daemons, etc.
