> which cannot be disabled (viaGUI)
Are you sure? I've just inspected my macOS 27.2 machine with my firewall and I couldn't find requests to smoot.apple.com while typing in spotlight(show related content and help improve apple search are both disabled).
I am certain only up to Sequoia; there is a new mini with Tahoe on it sitting here so let me replicate that behavior (if hostname isn't smoot., it'll be something). I've been meaning to update to GoldenGate (since buying it last week it has been used for just 2 hours, playing with LLMs on the default Tahoe); so I'll do this too and then see what the latest macOS's behavior is.
While I'm doing that, pull up your *.apple.com outreaches.
If you are not seeing <security.apple.com> on any Silicon's boot, you are not seeing full logs (all Silicon, and macs since T2, do this reach-out pre-post).