Is the problem caused because GlassWire reports false positives?
You are correct. This question appears to me related to understanding of OSI Model.
NetGuard is based on VPN which makes use of
TUN interface at OSI layer 3, while
GlassWire collects data from NetworkStatsManagr which is something within Android's Java runtime e.g. the creation of sockets happens at top layers; Application or Transport. And the UID based data usage is collected from qtaguid module of
iptables which also operates at OSI layers above 3.
Making use of Per-app VPN configuration, NetGuard asks the OS to only send traffic from app XYZ through TUN interface so that it can be forwarded through a VPN connection (which it never does). When we see apps from top, it looks like the apps are sending network data which is moving out of the device, but in actual it's blocked at layer 3. So IP packets even don't hit the physical layer.
This fact is self explained by
GlassWire app. It has a builtin firewall which is also based on VPN; no other possible way for non-root apps. When turning on this firewall, it warns that user will still get data usage stats for blocked app. The reason is as stated above, data is measured on upper OSI layers, blocking occurs at lower level:
That's why sniffers work at OSI layer 2, or even better is to watch from outside e.g. using a proxy server or at router.
Therefore, it seems that users who buy any Android phones are denied full control of the phone, even if they have installed privacy protection apps such as NetGuard.
NetGuard and similar apps have become somewhat privacy protections apps just as a side effect of Android's VPNService API which wasn't intended for this usage. Such apps can do app filtering based on
SOcket_MARKs which Android uses to categorize the network traffic for different purposes. If they wanted to give users freedom of choosing which apps can access internet and which can't, they could simply set Protection Level of android.permission.INTERNET
dangerous, which doesn't favor their business model; consider the fact that Google is biggest search engine and
ads are their prime source of revenue.
Advanced users who want a more fine-grained control on privacy, usually root their devices and make use of lower level things like Linux kernel's builtin firewall
iptables. Also some custom ROM have such features built-in.