Who verified the application firewall so that you can know it isn't hiding things from you (failing to report on transmissions to a hidden whitelist, for example)?
To your original point, I think it's better to buy an unlocked phone from the start. Subsidized phones will always have more strings attached.
Does not mention where phone comes from, how many phones they tested, there is no independent confirmation...
Anyway my Lenovo comes with application firewall. We are yet to see something like that from other makers :-)