Almost every PC purchased these days is connected to the Internet in some fashion or another, whether via a modem into an ISP, through an enterprise WAN, or at least with some sort of e-mail gateway. The now-infamous Distributed Denial of Service, or DDoS, attacks against eBay, Yahoo, and so on are just very prominent examples of the havoc that can be wreaked by a cracker who manages to compromise computers owned by innocent third parties, and then use said machines for his or her own evil purposes. We have to pay attention to the OS and services running on our machines, of course. This is known as a host-based security approach. This is called an infrastructure-based approach to security.
Firewalls are an important part of an infrastructure-based security approach.
For large commercial and government organizations, there are a number of products that can be used to secure the organization's Internet connection. The Raptor product from Axent and Firewall-1 from CheckPoint are two of the most prominent, and with good reason. They're very well engineered, are very configurable, and have a proven track record in the field. Because my internal network uses a non-routable address system, even if someone was to break into my Netwinder the intrusion would stop there. I have my Netwinder's filtering rules set up to basically let anything that originates from my private network reach the outside world, but to severely restrict inbound connections.