It is shipped with the firewall turned off because that will result in Apple receiving fewer complaints and questions from people. The alternative is to deal with all the "I can't access…", "I can't receive…", I can't download…" queries. Is this safer for the end user? Irrelevant question since we can't control Apple. Take it or leave it.

I strongly second the above comments about getting software to store your passwords. These applications can be accessed with a user-determined keystroke, use fairly strong encryption to store your passwords and many allow secure access from iDevices (convenient and also serves as a backup to the original on your computer). Many (e.g., Data Guardian) also can handle importing from Excel, which will save you enormous amounts of time.

On a Mac since 1984.
Currently: 24" M1 iMac, M2 Pro Mac mini with 27" BenQ monitor, M2 Macbook Air, MacOS 14.x; iPhones, iPods (yes, still) and iPads.