Android grants network access broadly. An application that declares the internet permission may contact anything, and there is no built in way to distinguish an application that needs the network to function from one that uses it for something else.
Karma Firewall closes that gap without asking the user to understand anything about networking. The interface presents installed applications and a switch for each, and traffic to and from a blocked application is refused. There is no rule syntax, no address list, and no ordering to reason about, which is a deliberate reduction rather than a missing feature, because the decision being made is binary and framing it as a firewall configuration would obscure that. The reason it is worth doing at all is that a large proportion of applications request network access for advertising, analytics, and crash reporting rather than for the function the user installed them for, and an offline calculator, a torch, or a local file viewer will frequently contact remote servers on a schedule. Blocking those applications entirely costs nothing in functionality and removes the traffic completely, which is a stronger outcome than a tracker blocklist that has to recognise each destination.
The limitation is the same Android constraint every such tool shares. It works by holding the VPN interface, so no other application requiring that interface can run at the same time, and choosing this means choosing it over a tunnel.