isn’t this essentially built into Windows these days? although it seems to come with a lot of programs pre-approved.

No, the Windows firewall in its default configuration does not restrict outbound connections in any way. Any application can make any outbound connection it wants. If an application attempts to listen for incoming connections from external sources and there is not an existing policy, Windows will pop up a dialog asking the user if they want to allow this and if so whether it should be allowed to listen on all networks, only networks marked as "private", or for domain-bound corporate computers only networks where the domain controller is reachable.

It can be manually configured with very detailed policies, but you have to know where to go to find those controls.

It's been a while since I used ZoneAlarm or Little Snitch, but the last time I used either one the default behavior was instead that any connection attempt or attempt to listen for which there was not a policy would result in a dialog showing all the details about what application is looking to connect to or receive connections from what as well as a variety of options for creating a policy or even not creating a policy and just deciding whether that one connection would be allowed.

Also back when I used ZoneAlarm I had dialup so the taskbar addon they had which showed realtime bandwidth usage and what applications had active connections was really useful. It also had a big red "Stop" button that would immediately disable all connections, which thinking about it in retrospect really makes me miss the more innocent days of the internet.

Iirc the firewall was already in XP. Maybe earlier but sp2 for sure.

Default allows everything though but you could even set outbound blocking rules. Cumbersome UI and no really good visibility though.

Most of the windows firewalls tools are just front ends for the integrated one with more sensible defaults.

You gonna commit seppuku if you try to add rules with the built in one.