It happened to me when I was configuring IP geoblocking: Only whitelist IP ranges are allowed. That was fetched from a trusted URL. If the DNS provider just happened to not be on that list, the whitelist would become empty, blocking all IPs. Literally 100% proof firewall; not even a ping gets a pass.
I think the difference with Dolphin is that it now emulates an extinct system(s), so it cannot possibly compete with the actual thing. They did have a close call last year, if I remember, and they pretty quickly went into “jettison all illegal shit out of the code base NOW.” -mode.