I recently set up a local server on my home network to host some files and personal webapps. In an attempt to improve security, I bought a pfsense-based firewall. I know some basics of networking but I'm not particularly advanced, so I tried to do some general reading about firewalls as I was setting things up.
There was a long thread that I read on some forums where the benefits of firewalls on a home network were discussed. The general consensus seemed to be that if you were to hook your computer (say a Windows desktop machine) directly to the internet with no router or firewall, that it would very quickly get compromised. This seems to (at least intuitively) make sense, as a computer is running lots of software, where any application could have some vulnerability. Things might be patched or not.
So here is where my question is: If the pfsense firewall essentially running a full OS (FreeBSD), then what makes it any more secure than a desktop machine plugged directly into a firewall? The firewall is loaded with software like VPN servers, DHCP servers, cert CA, DNS resolvers, firewall filtering, logging, admin interfaces (the web gui), and so on, so it's not like it is running a particularly lean configuration. In addition, desktop machines update very quickly, while the firewall OS hasn't been updated in over 5 months.
In fact, I wonder if running a firewall like this simply increases the amount of attack vectors compared to something much simpler like the NAT on a basic router. This also means that if the firewall is compromised, all those services mentioned before would also now be compromised.