While on one hand Manjaro is very polished. Some things they do is questionable. Like the time they suggested to change your date and time because they let their repo keys expire. Or accidentally DDOS the AUR. Just to name some. The Manjaro team has a rather bad track record of these things.
In my case not at all. But that is by choice. I always start from a server install. For me i like rolling as i do not get major version updates. And with tumbleweed it is very solid at the same time. Snapper and btrfs are also great aditions.
Their are not many programs that require open ports for incoming trafic. Things like ssh or a web server do. But then again those are services you would manualy want to open anyway.
Honnestly. Firewalls shut be enabled by default. Specially on laptops connecting to public places.
A good default shut be choosen by the disteo maintainer. A default shut not overwrite your own config. Like any config really. So no upset folks that like to change the firewall. Also if you dont block much outgoing trafic you are not likely to run into problems. And for people that like to poke holes in the incoming trafic. Your a “advanced” user anyway.