Unintentional exposure of bound services due to inactive default ufw

KDE Neon, based on Ubuntu LTS, installs with the Uncomplicated Firewall (ufw) in an inactive state by default. This configuration means that any service bound to all network interfaces (0.0.0.0) is immediately reachable from external networks unless the user manually configures rules.

While the official documentation suggests enabling ufw for network isolation, the installation process does not provide a configuration prompt or a default-deny incoming policy. This creates a risk for users who inadvertently expose development tools, databases, or debug ports to the public internet or local area network when the machine is connected to a non-trusted environment.

Is there a roadmap for transitioning to a default-deny-incoming stance in future KDE Neon editions? What are the recommended default policy sets to prevent accidental exposure without breaking local KDE features like KDE Connect or containerized bridge networking?