The built-in Windows firewall is now advanced enough that third-party firewalls typically don't have anything left that is useful and novel to bring to the table.
So security experts generally don't use third-party software-based firewalls. There's value in hardware firewalls, which offer a layer of protection against a compromised host, and there's a value in software firewalls, which offer a zero-cost baseline level of protection for all devices or a fall-back secondary layer of protection beyond just an external HW firewall. But really the one that comes with newer versions of Windows is more than sophisticated enough to fit that role. The additional security to be gained by installing a third-party alternative rounds to zero.
As for the general question of trust; that really is the kicker. I trust Microsoft to patch Windows because... I have to. Do I trust Adobe to update flash correctly? Oh, how about this: do I trust Oracle to ship spyware-free updates to Java? (Stupid
Ask toolbar). But if I can't trust Oracle, then who can I trust to update Java. Or... do I just have to abandon Java altogether?
You don't so much watch the watchers so much as you pick the watchers when it comes to application security. Either you trust the vendor and install their software, including its updating and tracking behavior, what every that may be ... or you don't.