Me neither. Maybe your client had Little Snitch installed and didn't remove it through the uninstaller but manually or through some other 3rd party software like AppZapper?
I also tried reproducing it with two clean installed OS. Now I know that it happens when you install a Mac OS Update after you've installed Little Snitch.
It could also be a problem of interaction between Virtual Box/Parallels, Little Snitch and the OS Update.
I didn't had any and don't want to invest my time in this any more. I've reported all of it detailed to Obdev and they say they can't reproduce it. I think they didn't understood how to reproduce it or they didn't want to understand it given that cynusx and I are able to reproduce it.
However, like the Apple Pro hardware there goes the best (and only?) application based Firewall for outgoing connections.