Windows comes with its firewall turned on by default since XP SP2, most popular distros doesn't do that even today.
Windows 10 doesn't even respond to ping by default (which is a pita).
Not sure about other distros but opensuse comes with a pretty strict firewall out of the box. My logic says that this is probably common practice for many general-use distros.
Ubuntu and debian does not. Well, they are installed and debian is enabled too (but defaults to allow all traffic).
openSUSE uses a password protected root account (shared secret), doesn't use ASLR and doesn't even run apparmor...