I too had the same question and found the available documentation/links confusing and/or economical with the truth!
Basically it appears that with the "custom" setting in the resultant category list all items are inactive (including desirable Phishing and Malware) and one has to select using the tick boxes on the left to include items one wishes to block. I would certainly have expected the Phishing and Malware category to be active by default as in the other age categories!
