HOSTS file lock?

Agree. To be honest, it took me time and searching for answers to figure out principle when i first came across with similar cases.

Yep, you are right, in some cases it is very convinient and safe to choose trusted/windows app without remembering (for 1 session only).

That definitely would be better than voting stat.

True. But HIPS (even best) is only half of safety. Another half is user. Remember discussion about rootkit or something when answering “allow without remember” on “some_exe tries to access service control manager” alert would be fatal mistake, though alert is quite usual and unremarkable. Anyway, i can mix up something about this case, Ragwing knows better.