Blocking incoming connections on a mobile device is less important than blocking outgoing connections given the threat model of a multitude of mobile devices running basically black-box applications which have access to a range of sensors. The main threat here is applications gathering data - of any sort, from positional to audiovisual to network traffic to (financial) transactional - and sending it off to their masters. The threat is, so to say, inside the walls already, not outside. The task it to make sure it does not communicate to the outside world.
iOS does not allow fine-grained control over outgoing network access. The assumption is that the user trusts the application to not do anything untoward, after all it was vetted by Apple before it appeared in the store. There are ways to get this type of control on iOS but since the first step you need to take is to 'jailbreak' the device this is not a real solution.
Android does allow this type of control through a multitude of firewall (i.e. Linux iptables) configuration applications. Android devices running version 3.x or earlier need to be 'rooted' to gain access to the firewall configuration, later versions (from 4.0) don't require rooting. The 'no-root' firewall works by routing all traffic through an on-device VPN (which can be instantiated without root access as of Android 4.0). This does mean the firewall application gets access to all network traffic, making that type of application a good target for those who wish to subvert Android network security.