Also mostly a noob, but my understanding is that most of the value comes from having a subscription to the firewall vendors threat database, and using the box’s

Also mostly a noob, but my understanding is that most of the value comes from having a subscription to the firewall vendors threat database, and using the box’s deep packet inspection to verify gnarly stuff isn’t coming over port 80 or other common protocols. You want it in an appliance so that you can be assured of isolation from the rest of your network. You can run firewall software in a VM, but you would still want that VM’s host physically isolated or with dedicated NICs for the VM.