You don't run a firewall to prevent a compromised system from dialing out, you run it to prevent other compromised systems on the network from dialing in. Everyone on the same wifi network is an attack vector.

Good point. Most importantly, that's the far less annoying use-case: one can imagine a simple UX with a list of applications bound to LISTEN on an external interface for you to whitelist for an hour, a day, or indefinitely. I think browser exploits are still a slightly more common attack vector, but that's certainly an option.