Good question. I will attempt to clarify:

OP is saying that individual should run firewalls on their machines, that block port activity by default, and only allow traffic upon an approved request by the administrator account.

An interactive firewall.

One that blocks programs from accessing the internet and prompts the first time they try until you click a button that says allow or you choose the alternative which is deny. A program like this you’d have no reason to give it internet access, it’s something whose operations should be entirely local.