Maybe because 127.0.0.1 is internal communication IP and there is somewhere startup script that ensures /etc/hosts in templates is generic.
If you want to do it for appVM then do it in appVM but in /rw/ and by bind-dir mechanism.
If you want to block sites use sys-firewall or use @solenesys-proxy-out solution