I think you chose a bad example. Company firewalls exist to manage risk and liability for upper management, not to provide any type of real security. If a security incident happens, management wants to be able to say they did their due diligence and paid for the "best" firewall on the market.