At the enterprise level, it's not uncommon to remove access to device management from external and user-facing networks.
To add to what Tim posted:
Let's say you go all out and buy a $800 firewall and pay a guy $200 to set it up for you. Meanwhile, the RAT installed on your PC six months ago makes an outbound connection 30 seconds after the firewall is replaced and the hacker still have access. The only thing that's changed is that you're $1000 poorer. In fact, if you also have the firewall password saved on a device they have access to, they can poke whatever holes through your firewall they want. For incident response, the first step is containment. And that's a daunting task if it's beyond your ability to determine what's compromised.
What people forget too, is that online accounts are also assets to secure. You can wipe your router, your phone, and your PC but that doesn't matter if your Google account creds were phished when you thought you were signing up for free CS:GO skins.