DHCP uses raw sockets so it gets to skip the normal networking stack. See here for the same question on Reddit: https://www.reddit.com/r/linuxadmin/comments/flcsc8/nftables_not_blocking_incoming_dhcp_traffic/