Threat: your Linux machine gets compromised in some way (untrusted app, or compromised install package or update, or an app is compromised because of a vulnerability, etc.) and something on your system tries to "call home". So you want to prevent the call, basically neutralizing the vulnerability. You would spot it because you might see a notification saying "Gimp wants to connect to example.com on port 80: allow, allow once, deny?". I think it makes sense as a defense, doesn't it?
Yet apparently, if I'm not mistaken, there are no easy ways to do this on Linux, and no popular and trusted applications have been developed for this purpose (I googled and found several questions about this even here on stackexchange). Applications like AppArmor or SeLinux have been developed to control which files a process can use, but the same hasn't been done for network connections. On Windows such applications are very common and part of firewalls. Is there a reason the same has never been common on Linux? I don't think configuring the allowed network connections can be harder than configuring the allowed files in AppArmor or SeLinux, so it can't be a matter of usability.
I have to say maybe I've found a way to circumvent such methods. Most users will probably have to set a rule that allows the browser to connect to any host on port 80. Therefore malware could just try to copy itself inside the browser (patching it or as a plugin), and then it would be free to connect anywhere on port 80. Nevertheless, I don't think this makes trying to avoid untrusted connections totally useless. By the same reasoning, malware could patch AppArmor or its rules to be free of doing whatever it wants, but this doesn't make AppArmor totally useless.