People were building firewalls in 1988, several years before there was even Trump Winsock, let alone a reason for PCs to need to filter Internet traffic.
Yeah, you can always make this argument. "If only there had been sufficiently advanced and non-buggy firewall rules in place in firewalls optimally placed in the topology, looked after by competent networking staff"
It just doesn't work in most environments because you don't have firewall experts on staff and you have no incentives to spend money and effort on firewalls.
(And even for professional firewall wranglers it's hard in normal semi-chaotic IT organisations, you don't intrinsically get any assurance things are set up tightly, or that it remains so after network configuration changes, and you keep breaking working systems, you just get feedback for angry users that you've inconvenienced and you never get feedback from successfully defending against attacks. etc etc. And at the end of the day for the same money you could have gotten better security improvement by spending man hours (and hours lost by impeding your users) elsewhere, in line with end-to-end thinking.)
> If only there had been sufficiently advanced and non-buggy firewall rules in place
We don't even have to look for ideal or advanced solutions. First forbid spoofed IPs, then kill incoming low port traffic to residential users (but let them opt out of that, just like we already often do with outgoing port 25). This applied globally would kill a large chunk of DDoS attacks these days. But today's ISPs are not doing even that.
I don't know how we can convince people to care enough.