In Fedora CoreOS, users are expected to run their services in containers, as is the case with this topic. When you run applications inside containers, those are connected to an local internal network by default and are not exposed to the network. You usually control which ports are exposed to the network using the --publish option.
This means that adding any firewall configuration for incoming connections will usually duplicate those container runtime configuration, without any additional security benefit.
Moreover, the list of services that listen by default in Fedora CoreOS is quite limited and is actively being checked in CI.