Firewalls are essential for everyone, this I understand.
That I don't know about. It helps in having a layered security environment but is it essential? That's been a bit of a debate going on here for a while. In one of my courses I'm changing the labs so that students are required to secure a network without a firewall. The reason? I think too many people are using firewalls as crutches.

They configure firewalls well enough but forget to harden their systems and ensure their systems are secure. They make the assumption that attacks will only come from outside the network and forget about the 40% potential of attacks from inside (e.g., disgruntled employees, curious employees, malicious employees, contractors, etc.). There seems to be this idea that we depend on firewalls solely for our security when in fact it is a combination of a lot of things, as you've pointed out.

Though, this whole discussion is mote if we don't have a savvy user (which probably represents -- I know, generalization -- about 80% of all users out there).