Exfiltration isn't only a network problem
Data exfiltration is the unauthorized removal of data from a system's controlled boundary, and the category is broader than the network-focused paths most access-control design instinctively concentrates on — an upload to an external service, a copied database. A printed document walked out of a building, a screen photographed with a personal device, or a screen-share left running to an unintended audience are exfiltration through the identical underlying definition, just through a channel a purely digital access-control system has no visibility into whatsoever.
Print output specifically deserves separate attention because it converts data into a form entirely outside the reach of any subsequent digital control — a printed page can't be remotely wiped, its access can't be revoked after the fact, and once it leaves the printer it's subject to whatever physical security exists in the building, which is usually a completely different discipline from the digital access controls governing the same data beforehand.
Extending policy to a medium most controls ignore
Closing this gap usually means policy and monitoring specific to the medium — restricting which sensitive documents may be printed at all, logging print activity the way other access is logged, watermarking output to trace a leak back to its source — rather than assuming an extension of network-focused digital controls will somehow also cover this channel. It won't, because print output isn't a network event the same tools are built to observe.