the SDKs need to embed their own PrivacyManifest.xcprivacy, as does your app. When the PrivacyReport is generated from the app Archive, it will scan all embedded PrivacyManifest.xcprivacy's to generate its report.

yes, ios will block network access to listed domains. you can verify this yourself locally.

the same document has your answer: f you set NSPrivacyTracking to true then you need to provide at least one internet domain in NSPrivacyTrackingDomains; otherwise, you can provide zero or more domains.

How can I check if PrivacyInfo has been added to IPA? Organizer->Generate Privacy Report

Rebuilding is the preferred solution over running shell scripts to just strip the bitcode Actually the preferred solution would be for the linker to strip bitcode sections if ENABLE_BITCODE=NO, so nobody would have to deal with requesting 3rdparty frameworks be updated.