I noticed this as well. I suspect it's to allow push notifications for the UA app to work (since the rest of the app works) and since all push notifications come from the same pool of Apple servers they couldn't whitelist only their app's notifications.