If you set up an edge router with IPsec capability and mandated that it only communicate with other IPsec nodes, then it would indeed perform many of the functions of present day adhoc firewalls. Unfortunately, most home users would consider this to be totally unacceptable, because they could only communicate with cooperating IPsec sites, and not the rest of the net. For this purpose, IP masquerading is an ideal tool. Although masquerading provides some security, its main point is IP address sharing. The latter problem is easiest of the bunch to solve.
Tunnels provide a different answer to making internal machines addressable.
NAT makes your internal machines appear to use a single gateway address. Tunnels provide direct addressability for internal machines, but only for machines at the other end of the tunnel, not the entire internet. Ad interim, Fireplug's priority is encrypted tunnels, which are far easier to set up, and are available for 2.2.x kernels.