Yeah ofcourse firewall is the good idea here. I personally have firewall on on every device so that I can manage what can connect and from where.
The point is though often people just disable firewalls (some distros do not install/enable by default too) to workarround certain issues quickly like kdeconnect not connecting, bridge not working and such. That’s how I think the whole ‘ipv4 NAT is the best (consumer) firewall’ concept came popular.
Forget gpus. A framebuffer is all you need :)