If nothing is listening on a port, no connection can be made to it, firewall or not. The same applies for desktop computers and servers. In theory, you're still safe without a firewall if nothing is listening and the TCP stack in the OS isn't vulnerable.
We have the habit to use firewalls on desktops/servers because they are available and every layer of security helps, but mobile OS developers thought that was unnecessary and are confident in their TCP stack implementation (I suppose a firewall would induce additional CPU load which will decrease battery life).
There is actually a long debate on Serverfault about whether you should use firewalls on servers, you should check it out and make your own choice whether you want to install a firewall on your mobile device.
Also note that most mobile networks out there use carrier-grade NAT which means, at least on IPv4, that your device isn't directly reachable from the Internet and this provides some sort of basic protection (you're still exposes to attacks coming from that same mobile network). Of course this point no longer applies with IPv6.