Comment by mahboi

Sure, but it's evidently not that bad. And actually safer than firewalls because the default is so strongly deny-inbound. Most people absolutely don't want random devices on LAN to be exposed to WAN, and those with servers can get a public IP.