Comment by teraflop

A couple of obvious reasons:

- You can apply more flexible rules than just blocking specific hostnames -- for example, based on IP subnets, port numbers, or specific binary executables

- You can block connections even from programs that bypass the default system-wide DNS configuration