Some people are hesitant to use Windows Firewall because it allows software to alter its state via an API. The benefit of this is that the Firewall configuration can be centrally manged in GPO.
On the other hand, malware can change or alter Windows Firewall settings unbeknownst to the end user.
Has anyone, vendor, or even research group studied the impact and ramifications? What are your experiences with "programmable firewalls"* and should they be used?
Looking at the problem from the other side - it's not just about presenting a nice face to the user. Although I'm not aware of any tools for MSWindows which adapt the behaviour of the firewall, fail2ban is a very commonly dynamic response tool on Unix type systems. Most attacks cannot be differentiated from genuine traffic at the packet level - fail2ban looks for patterns in the logs (most commonly for ssh but can be used for anything which can write logs) and applies temporary bans.
As with so many security controls, they should always be considered as part of a defence in depth strategy. A personal firewall on your machine adds useful protection, but should not be relied upon as the only protection.
(I say personal firewall here because the vulnerability you identify - if malware infects a machine and escalates privilege it can disable/modify a personal firewall running on the same machine - applies to all such products, not just the Microsoft one.)
