We actually gave up on wrong-layer firewalling where I work, as it was just too much upkeep. We had enough engineers (… like two dozen, so not a lot in absolute

We actually gave up on wrong-layer firewalling where I work, as it was just too much upkeep. We had enough engineers (… like two dozen, so not a lot in absolute terms) and ISPs rotate public IP address assignments way too often. And every time it happens it takes a while, as that person has to debug with usually terrible diagnostics. (Since the network is just dropping their packets.) The thing about v6 is … you can just firewall permit like the entire North America block to whatever ports absolutely must be exposed … and just not get any attacking traffic?, at least if the address isn't somehow otherwise discoverable. This isn't possible on v4 (there is no such block, due to the space's fragmentation), and opening up v4 otherwise does expose you to a cesspool of incoming maliciousness. (Though … there are tools for this.) If there was decent tooling available to me for "here are the IP addresses of the userbase" (e.g., some sort of phone-home system) that could keep the firewalls in sync with reality, I'd be more enthusiastic about it. But the status quo is largely "security teams want IP firewalling, but don't want to figure out how to actually implement that in a manner that it will realistically work and not waste engineers time filing dozens of security requests".