you say "SANS has articles about indexing". That sounds like interesting reading. Could you please give pointers to those articles?
Reason for asking: my opinion is that it is not dangerous to disable the firewall. But still, it is a bit unwise.
I have had since year 2014 (if I recall right) directly connected IPv6 without any firewall at all, but there have never been any attempts using IPv6, even if the primary devices sit in the addresses ::1 and ::10. With IPv4 it happens all the time, trying SSH, trying HTTP vulnerabilities, trying common usernames and passwords etc. I use fail2ban, and additionally I route a bunch of large /12 ... /16 IPv4 blocks to /dev/null because they are useless for me. Without those the number of log rows from IPv4 attempts would be well above 100.000 per day. But as said, never anything with IPv6.
I am not saying that IPv6 attempts will not come. But I consider IPv6 much harder for hacking because of the trillion-size address space.
If I would need myself to break into a /64 IPv6 subnet, I do not know where to start from. Perhaps I should first use some other means (fake phone call about support?) to find what equipment is in that destination, to be able to guess ranges of MAC addresses and the calculated IPv6 addresses, instead of shooting randomly the 2**64 block. Or concentrate on such vendor MAC addresses where the vendor is known to have certain vulnerabilities.