Is that build based on Android 12 ? If so I might be wrong about no custom ROMS adding that feature back in. Maybe grapheneOS and some other ROMS made their own patches to fix it.

Settings says "Android 12" and the build date is this month, so presumably, yes.

Their firewall is pretty simple though (per app enable disable). Does lineage support more complicated policies?

On my phone running LineageOS 18.1 (Android 11) I have the following on/off options for every app: Allow network access, Wi-Fi data, Mobile data, Background data, VPN data, Unrestricted data usage (even when data saver is on)