Why does the windows firewall allow apps to communicate through so many different ports and to so many different addresses?

Question

I looked at my default windows defender firewall on Windows 10 22H2, and most of the rules allow apps to communicate through any local port to any remote address and port. I have read other questions and answers but none seem to address the attack vector of a trojan executing through those apps. As I learnt in the classroom:

1. some ports are reserved for certain protocols and applications
2. App servers have a static IP(example: app servers for discord have a specific IP or set of IPs that will not change under foreseeable circumstances)

As such shouldn't the Firewall rule for Discord be set to communicate with that respective IP, and through the port that it is programmed to use?

I believe these lax rules allow first stage Trojans to download further malware, and/or communicate with attacker to leak my info to create a bot-net ........(or otherwise further it's malicious purpose over the Internet)

I just need to confirm that my reasoning is logical before I go ahead and change my Firewall rules. So that I make it more secure instead of destroying functionality of the apps on my device.

Answer 1

"that respective IP" - which IP? Discord has many around the world. Is your idea that Windows maintains an up-to-date list of all major services and only allows traffic to those? And which major services should be on that list? IPs change all the time.

For the average home user, they need to be able to access what they want. That means a permissive list. So, in this case, yes, the firewall does not protect against malicious outgoing requests. And that's ok. That's better than locking the firewall down and suddenly, granny (any granny) can't send emails.

So, go ahead and lock down your firewall as you need to. But I think you will soon realise that for a home machine, that can be tough to maintain over time.