The bypass: DNS is almost never blocked
Corporate firewalls block most outbound traffic — but DNS (UDP port 53) must be allowed for internal resolution to work. Attackers exploit this: encode data in DNS queries and use an attacker-controlled nameserver to receive them.
The key: the firewall can't easily block DNS because everything breaks without it.