I have mixed feelings on this:
- on one hand, nothing listens on these ports by default; and they have a point that it does break user applications;
- on the other hand, they should be closed, and users should open them explicitly once they install an app that needs it. However, I'm afraid we would see exactly the same thing we see with SELinux: many tutorials about installing apps or services start with "Disable SELinux" instead of how to enable exactly what is needed. We would see the same thing with firewall and "Disable firewall" as step 1.
- as a sidenote to the second point: many apps do not ship with firewalld profile, so it is not a matter of `firewall-cmd -add-service $appname` either.