It appears I forgot to put in the wildcards for the t.co/ test. 
Running it again with *t.co/* does indeed block the spam link first time as intended. 
But I think you’ve found the difference. Approval is different to Blocking, though I appreciate there’s a case for some kind of supervision of the edits as well as the initial posting. I’m not sure that’s a bug as such, as I think it works the same as the other topic/post approval methods? It would be a good addition though.