What does a firewall help when Windows can bypass it in the kernel?

And embedded stuff aside, a system with a firewall whitelist on a separate box is unusable for daily use...