People who say it sucks usually don't have a grasp of what it can do. The UNIX underpinnings of OS-X have been around for a looooong time.
The built in OS-X firewall's is okay but there are some apps out there to help users tweak it.
The built in firewall is actually very powerful but you can't exploit the capabilities using the standard interface through system preferences and tweaking with the command line is out of the question for most average users, myself included.
I know the apps are out there, I have come across them.
Can anyone suggest where to look?