It’s off by default..

Why?

Because it's annoying and it doesn't help — most people don't care for managing a firewall, nor should they. If an attacker has run an executable on your laptop, whether you block it from phoning home or not is hardly your main concern.

You don't run a firewall to prevent a compromised system from dialing out, you run it to prevent other compromised systems on the network from dialing in. Everyone on the same wifi network is an attack vector.

Good point. Most importantly, that's the far less annoying use-case: one can imagine a simple UX with a list of applications bound to LISTEN on an external interface for you to whitelist for an hour, a day, or indefinitely. I think browser exploits are still a slightly more common attack vector, but that's certainly an option.

Because it's an ingress firewall and by default netstat -an returns zilch, so a firewall would have zero work to do.

┐(°—°)┌

I'm not sure, but maybe simply turning the firewall on in macOS doesn't provide any benefit if everything else is fine, and you have to lock it down and disallow all requests by default to actually get added security through it.

Edited the recommendation after reading the sibling comments.

Because a hardware firewall is infinitely more effective. If your router has a firewall, that should be turned on first. If it doesn't, that's when you should look at turning on the Mac firewall.