My take-away from that sentence was not that having 3 firewalls was the poor default, but that having none of them enabled by default was, instead.