Most home routers (not all) allow outbound connectivity regardless of destination or port; they only generally filter incoming traffic. Some of the better routers do offer full two way rule sets, but for the home use inbound filtering is generally considered acceptable.
If a machine becomes compromised via say physical media such as a USB stick a software firewall may block and prevent further infections to other machines and potentially even alert the user that outbound connections are being made when they prompt or via logs if one is to review them.
They are also aware of the application instigating the connection; depending on the solution you can allow Chrome to establish an outbound 443/80 tcp connection but prevent iexplorer.exe and any other none chrome.exe tool. They're a little more granular in that respect (compared to home solutions, I'm not comparing to enterprise or above here).
I'm of the belief that for most users, a decent router naturally protects a machine to the degree it becomes the least likely method of infiltration. There's plenty of nasties that transverse allowed ports that even the most sophisticated home grade firewalls will allow infected traffic to pass however you need to back it up with running latest versions of key components (ie windows update) and a half decent virus / malware protection for an all round solution that's not fool proof but better than nothing.
The best protection IMO is to pull the network cable and the power cable, then nuke it from orbit.
