Generally, firewalls aren't going to save you from an internal compromise either. Are you giving each device its own VLAN, subnet, etc?
reply> Generally, firewalls aren't going to save you from an internal compromise either.
replyRight, but it's easy to get in the mindset that because devices are on the "inside" network they are safer. This is the risk that NAT brings: RFC 1918 = safe(r).
If every device has a 200::/3 address, then even if there's a SPI firewall which prevents external connections, it may help to reduce this inside/outside thinking.