That's fair, I can see how any kind of more advanced filtering than "just block incoming SYN packets" would require state, but at least it's optional.