Hackers can fool such firewalls by forging source addresses via IP packet spoofing. Since client-server connections are direct, hackers can also use packet sniffers to discern a network's address structure with relative ease. In our library analogy, the equivalent of a packet-filtering firewall would be the librarian keeping a list of trusted students, then allowing only those individuals into the locked stacks to retrieve books. This might make book retrieval faster, but it would require that a list be created and maintained. It would also be vulnerable to impostors who turn up at the front desk bearing fake IDs.
Proxy servers are different.
Since the latter is the only address the untrusted network is aware of, spoofing attacks are no longer possible. Because they operate at the Application layer of the OSI model, proxy servers can do a lot more. Each of these proxies accepts only packets generated by services it is designed to copy, forward, and filter. Application-specific proxies are almost infinitely configurable. Proxy servers also do a superior job of logging network traffic, and can ensure that connectivity is always available for certain traffic types.