iptables will consume resources on your droplet (CPU/network) to filter out the traffic. Cloud Firewalls are applied directly by the DO network, before ever hitting any of your droplets, so it uses none of your resources.