Quarantine group escapee flows... how?

I have quarantine new devices on, and yet, somehow, a quarantine group device was able to have both inbound and outbound traffic. I can provide logs, here's the MSP screenshot: