All inbound traffic is denied by default

However, all OUTBOUND is allowed by default.

So - if there is a need to ensure that the default VPC instances see no traffic - either inbound or outbound -  then, an additional Firewall rule needs to be added. To DENY all outbound traffic from the VPC