I use both hardware, and software firewall. Software firewalls use so little CPU time, there is almost no point in running without them. While the hardware firewalls are 'generally' the best protection from active hackers, port scanners, and script kiddies, if you accidently download a virus, then your PC will open ports, and connect itself to a botnet.
The hardware firewall will 'generallly' be configured to allow all outgoing connections, and therefore the botnet will work perfectly.
On the other hand software firewalls are generally configured on a 'per program' basis, and as soon as the botnet software gets installed, you'll get a popup as the software firewall recognises the strange software. An instant indication that you downloaded something bad.
The 'easiest' way to break into a firewalled computer is via an authorised program, often your web brower, or email client. But Messanger clients are common targets too, It only takes 1 accidental click to end up with a virus and join a botnet, and if a weakness in the web browser is discovered then you 'can' get infected just by viewing the wrong site.
Common sence can help you avoid 99.9% of problems, but once in a while even the most carefull people 'can' end up part of a botnet. Software firewalls are still a usefull tool to keep your PC from becoming a hackers toy.