I am, by no means, an expert on pf, but I strongly suspect that many of the iptables extensions have no comparable capability in pf. Specifically, I don't know

I am, by no means, an expert on pf, but I strongly suspect that many of the iptables extensions have no comparable capability in pf. Specifically, I don't know of any deep packet inspection extensions for pf, ipsec headers (such as authentication info) can be used for filtering decisions in iptables, iptables has some cluster capabilities built in, iptables has DCCP congestion control rules, and so on. iptables, like Linux itself, just has so many people working on it, that almost anything you can think to do with it has already been done by someone and they've created a module for it. If you haven't run into the missing capabilities, they probably don't matter. I'm not suggesting people who are happy with their pf firewalls should replace them with iptables because iptables is somehow "better". It just has a lot more users and a lot broader ecosystem because of it. To be more clear: I don't generally use any of those features that iptables has that pf doesn't, and I don't think most other people to either; at least no such features come to mind. I think I have once or twice used things like the user extension in nearly two decades of system administration. I'm always surprised at how strong people's aversion to iptables is. It's really not that complicated. I mean, most of the people here are writing software in far more complex languages daily and don't consider it a huge endeavor. iptables is a very simple declarative language, with only a few syntactical elements, in most cases. But, I guess it doesn't look like what folks are used to, and networking is its own category of complexity that many people never dive into.