"I hear that firewalls mainly serve to stop stuff from getting out, as opposed to in." whereas the opposite is true.
There are tens of thousands of bots working 24 hours a day probing iP blocks looking for 'openings' into devices; done by sending various query packets.
When 'chinks in the armor' are found, further probative actions are taken...and Windows is chock full of open ports that permit packets in.
Firewalls greatly reduce that attack surface.
The 'outbound' aspect would alert when something is already inside the OS.
Firewalls do not add over-burdensome delays to 'Net exchanges, and DO NOT inspect packet contents...only the headers are examined and compared to 'asset request tables'.
Trying to manually configure the OS and monitor traffic would be a non-stop Herculean task, and best left to a hardware firewall (NAT router); software as a second choice.
"Ubuntu" relies on TCP/iP (et al) for Internet communications, but have far fewer "listening" ports by default, and are inherently safer than Windows, but: as the popularity of Linux grows, almost certainly the attack vectors will follow suit.
If you've had "trouble" with firewalls in the past, I would look for other sources of the problem rather than the firewall function.