Optimize your security measures accordingly. A loaded question. However, it depends on what's at risk and how much it's worth to you to protect it. You probably need something to restrict inbound access, and you might want to restrict outbound access to people who know how to browse safely. You can disable this, but then security depends on local and imperfectly understood configuration options on individual workstations.
Mail servers are vulnerable because they're visible.
Many sites simply live with this, keep their ears open regarding threat reports, and keep security fixes up to date. Maybe it is. If not, talk to the vendor of a strong firewall. It's the same problem. Server software tries to provide good, reliable service and to patch security holes as they show up.