> before this change, if a firewall creation failed, there would be an orphaned network instance created.

OK, then let's leave as-is and address the orphaned resource problem separate, as needed. Thanks for explaining!