Why do restricted apps still use data? I am on Android 10 and just ditched netguard firewall to rely on the systems build in restriction options.
But despite my below setting e.g. the Amazon app is still obviously online.


screenshot of the app's data usage and settings (click to enlarge)
Amazon is using data in two cases:


Foreground 
: App is active (foremost on screen), screen is on and user interacting with it. You would have probably done that in response to a notification or ad or launched the app. Even if you didn't interact with app but it is foremost on screen, it consumes data. If the app was updated by Play Store, it accounts data usage to the app (UPDATE_DEVICE_STATS permission) 
Background:


Amazon uses Google Cloud Messaging (GCM) (com.amazon.mshop.pushnotification. gcm. MshopGCMbroadcast receiver) 
to display push notifications which you see (ads/offers /delivery tracking etc) and this uses data. GCM (or FCM (Firebase Cloud messaging) is a part of Google Play Services and can't be restricted by disabling background data. If you want to stop background data completely, your device needs to be rooted (I use servicely which can also do this and I got the receiver information using this app)
In addition apps use analytics (Fabric/Crashlytics, Facebook app events, Firebase Analytics, Google Analytic, Mixpanel, Segment) which are not always bound by background data restriction. 



Bottom line Depending on how badly you want to restrict app usage data your arsenal would  need a rooted device, Firewall, means to disable services /receivers, hibernation tools, doze optimization methods etc, in addition to restricting background data.