Except that it doesn't. The infections will bypass the firewall, coming in on an already allowed vector (like IE or Firefox or Outlook) and then disable the firewall or go outbound on some allowed ...