From strictly a remote exploitation perspective... Why is it better to disable external services and properly configure authentication mechanisms than to run a software firewall?
Why You think that this is a better solution ?
And also I don't understand why you ask that here when you alredy have your own opinion ?
People usualy came here to ask something that they don't know, not for this kind of question.