In legacy networks, these are real problems. Also, you must consider the level of risk. These are the real issues. If you intend to connect your LAN to the Net, a firewall is not going to be enough. Relying solely on a firewall is a bad idea because new cracking techniques are always emerging.
Vendors say yes, as long as they are properly configured.
However, think about that statement for a moment. Crackers can already scan behind a firewall and determine the services running there. That is the first and most important step. It will not be long before firewalls get cracked, so be prepared. Try to think of it in terms of a path or a trajectory.