If you don't trust the platform then you shouldn't be using it. No bandaid like antivirus or firewall can help with that.

I mean, if you don’t have a firewall on the device itself then your router certainly does, your device requests xyz port open your router will oblige with UPNP unless explicitly denied.

The on-device firewall is just an extra step before it hits your router’s firewall anyways, I’m sure your devices have made contact with servers behind your back that you know nothing about.