Remember when Windows installs didn't have firewalls on by default and it was pretty trivial to attack people's installations via insufficiently-secure protocols running on open ports? It was a bad time.

HTTP has both elaborate tooling for deep packet analysis and a battle-hardened secured protocol, which we don't get with new protocols.

Well, yes, we used to not care about security as much.

These days, don't you think that consumer routers sold without firewalls should be about as illegal as selling cars with only motor braking ?