I tried using librewolf-unwrapped in opensnitch rules but that was a different store path to the one that programs.librewolf produces. I think the default package used by programs.librewolf if you dont set package must be different to pkgs.librewolf or pkgs.librewolf-unwrapped.
I looked at the Home Manager module source code for librewolf: home-manager/modules/programs/librewolf.nix at master · nix-community/home-manager · GitHub but there is no refence to the default package in that file, so perhaps it comes from the inherited firefox module code?