Well, it's critical to have a firewall fullstop, but that doesn't mean anything in terms of the story - a vunerability in server side services that require a port to be open has nothing to do with a firewall per se. If an internal network can be accessed via an exploit on a server with ports open to the net, then the admin of that network is just looking for ****.