I mean, I'm not close to Little Snitch's development but I'm pretty sure they used to use a kernel extension. Kernel extensions are deprecated but they aren't going anywhere anytime soon since it seems like Apple just built a brand new kext loading system to handle static kernelcaches