It is default ON in NixOS and will conflict with `firewall.enable = false`, which some user may intentionally set.
In my opinion it is very high-level option to be set automatically.
Also, people who really don't want firewall, just do `lib.mkForce false` and won't even notice that this module requires it.
