It is a linux based OS, Linux firewalls are setup that way, Like IPCOP, WAN & LAN. WAN is more secure setup because it makes use of the built in firewall, even though it is a LAN.
I suppose they designed these things so that they could be directly placed on the Internet. But then all you have to protect it is the password.
It's still a weird design choice. I'd be willing to bet that most people are going to put these units behind a router or firewall anyway. Certainly that's what I'm going to do. The only reason to have these units be a router is if they have to route traffic internally.
Maybe the boards themselves are Ethernet nodes on the internal LAN? If so, then I guess that would make some sense that there would be a router between the boards and the outside world. Ethernet for internal communication seems like an odd and expensive connection choice. Unless they wanted the ability to change the product configuration, like have a unit with 4 or 6 boards instead of 2.