Because a hardware firewall is infinitely more effective. If your router has a firewall, that should be turned on first. If it doesn't, that's when you should look at turning on the Mac firewall.