It seems that the status quo at the moment is to configure firewalls to drop any packets that aren't destined for specifically-opened ports. Many defensive port scanners (such as ShieldsUP!) seem to praise you for every port that has a DROP policy. If you were to port-scan any of the top domains in the world, almost all of them would show that their default policy is DROP except on needed ports such as 80 and 443.
What is the mentality behind this? It can't be for stealth, because if ports 80 and 443 respond then it would be extremely trivial to see that the host is up. It can't be for defense against SYN floods either, since you could just direct the packets to the ports that ARE open. The only thing that I can think of is that there are other services running on the outward-facing interface, but instead of taking the time to properly configure these services, admins just throw a firewall in front of it. Still, one would think that the top websites in the world would have their act together enough to properly configure their servers.
Am I missing something here? Does setting a default DROP policy really do anything to improve security on a properly configured server?
I just want to clarify my question a bit. What I don't understand is why people feel a need to put a layer up that drops packets instead of letting them through and letting the networking stack do its job. (Putting up a layer that responds artificially with RSTs would be essentially the same thing and it raises the same questions.)
I'm not trying to imply that a firewall is useless, but it seems as though people don't trust the networking stack to the point that they forbid direct contact with it except on allowed ports. What is the real harm in exposing it and interfering with it as little as possible?