Well, then you have to make it so that new instances automatically contain your packet filter. You have to think outside what the current implementation easily

Well, then you have to make it so that new instances automatically contain your packet filter. You have to think outside what the current implementation easily supports, which obviously reflects the limitations of the current network setup, and think about what would be possible if those limitations didn't exist. And it's obviously technically possible to automatically deploy the same packet filter to each VM that gets added to your network range ... Also, as I said, the point is not that a central firewall cannot ever be a good solution--but with the current limitations, you have no other choice even when it doesn't really make much sense.