There's a lot of snake oil security in the world, and the AV publishers and firewall vendors are a big part of it. But there are people doing real security research, actually working on hardening various pieces of software, finding vulnerabilities, etc.
It seems like the "anti-sec" people want to shut down real security research, the kind that finds vulnerabilities in software and forces vendors to fix them, with the result that most users would have nothing but snake oil between themselves and the criminals.
Of course I think the real motivation behind the "anti-sec" "movement" is transparently obvious: it's less-than-talented black hats who are pissed that usable exploits are being disclosed, meaning they're far less useful for nefarious purposes and get plugged more quickly. They would, I'm sure, prefer a no-disclosure environment where vulnerabilities stayed open for years, and were only known to the crooks.
It doesn't. I just wanted to point out that the security industry truly is full of shysters, and I suspect that's why the "anti-sec" rhetoric has a strong resonance for some people. They sound like elitist children to me, but there is definitely an underlying bit of truth in the arguments they make.
We see a lot of superstition about firewalls (and AV, for that matter) on world-facing servers in our support forums. Folks seem to believe that just having a firewall running on a world-facing server will somehow protect from random attacks...but, the reality is that every service you provide to the world is one that cannot be firewalled. And if you aren't providing that service, why even run something on the port? So, the majority of firewalls I've seen configured on web, mail, DNS, etc. servers are effectively a no-op. They block ports that aren't listening and leave the listening ports wide open. You can, of course, make use of stateful features to provide some protection against some types of attack (brute force, in particular; DDoS, as long as it isn't too widely distributed; etc.) Even more disconcerting is when I meet "system administrators" who believe that having more than one firewall makes them even safer, even though they don't understand enough about either of them to have them actually doing anything. This superstition is good for Cisco and the host or ISP that is renting the user the device, but really bad for security.
It's worth railing against firewalls because there are firewall products being pushed by the same snake-oil industry that pushes AV and other band-aids and using the same misleading tactics, furthering the level of ignorance in the population at large about what a secure network actually looks like.
So, yes, put a firewall and a router performing NAT between your local network and the world. It will dramatically reduce the number of attacks on those machines and dramatically improve the security of that network as a whole. But, don't believe that a firewall is a solution to all security problems (or even a majority of them); just like anti-virus, it's got a time and place, and the way it is often pushed by the industry as a generic security "solution" is a problem.
Speaking of superstition, I've met folks running insecure PHP scripts on a Linux box that got hacked (user-level access, spambot running, etc.) who believed that it happened either because they didn't have the right firewall or the right anti-virus configuration; and they'd spent a bunch of time already on trying to figure out why those tools "didn't work"; and their questions to me were in the form of "Can you help me fix my firewall|anti-virus because we got hacked?". This is the kind of superstition I think is really harmful. Folks spend so much time fiddling with things that aren't even related to the actual security of their systems, and ignore the important stuff (don't run old crap, use strong passwords, don't run things you don't need).