Going the long way round
/api/redirect/ is on this origin, so it is permitted. It sends a 302 to evil-cyber-hacker.com, which is not.
⚠️ No list is set. The browser follows the redirect to
evil-cyber-hacker.com without a second thought. Any destination you permit
becomes a usable route to every destination you did not.
Why the default is block
A list that permits an origin but not where that origin sends you is not really a list. Any permitted destination under an attacker's influence — a compromised vendor, an open redirect on a domain you trust — becomes a way to reach anything.
You can opt into redirects=allow if a destination you rely on genuinely redirects,
but that is a decision to make deliberately, and the reports tell you when you need to make it.