You most likely already have one installed, but not enabled. It doesn’t harm anything (maybe you need to allow traffic to ssh or other configuration, but after that you’re all set) and it’s a layer of protection, specially if you need to move between networks (public wifi etc).

No - If you are aware which programs open incoming ports. E.g. check with netstat -tulpe

Yes - If you want to make sure e.g. TCP port 22 or a webserver on 443 etc is only available from IP/Adapter xy. Or if you want to mess with filtering outgoing connections.

Yes, and hopefully you will have one preinstalled, blocking all incoming connections.

An outbound firewall like Opensnitch or Portmaster is also nice. But here I would say often you dont need one. Balena Etcher was the only App loading Ads, at all. Firefox and Thunderbird can be hardened. The rest is okay and doesnt phone home, Flatpak permissions ard also great.

Eh, the router acts like one. I have no open ports. On a laptop you use on the go I would use a firewall tho.

Do you need a lock on the door of your place?

No, but it’s a damn good idea to protect whatever is in it.