Sure, firewalls block unwanted service access, but what about exploits to allowed service traffic like Email and Web? It's nice to have a little extra cushion. Our primary datacenter uses 3Com's TippingPoint to block commonly attempted exploits.
