This isn't Windows where there's a million and one (unrelated) services required to be running.
Then you are artificially limiting the discussion. OP asked whether firewalls on servers should be enabled. He did not restrict it to just *nix servers. And even so, those services needed for the server to work are limited by the number of functions the server handles. Generally, from the perspective of security, the server should handle fewer functions in order to limit risk. How practical this is...just depends. There is always a compromise involved, but the more critical the data is the less you should be willing to compromise.
Ask Maersk:
https://www.wired.com/story/notpetya-cyberattack-ukraine-russia-code-crashed-the-world/
And how is your dynamic website supposed to get its data if it's not allowed access to the database? If it's allowed access to the database you're already opening yourself up for SQL injections. A firewall, local or otherwise, isn't going to change that. Neither is splitting the database servers off on their own VLAN. The website needs access to the database and you'll have to deal with that, i.e. poke holes in firewalls.
Well, that depends on the data that is in the database and how you have distributed and segregated your data to enhance security, now doesn't it. And, to the extent you must allow web access to sensitive data, you still gain considerably by having that database on a different server, on a different vlan (with vlan-vlan access only for a small number of specified ports and to/from specified machines). If it shares the server that is the webhost, and I crack that webhost, then I have gained full access to that data. If the data is on a different server than the webhost, and I crack the webhost, I may have access to a port that has access to the data but I still have to deal with the security protocols on that separate server; I do not have full access to that data and (depending on the security protocols between the two boxes) I might not have ANY access until I take further steps. Since it is on a different vlan, has a firewall, and my access is controlled by the router that controls the vlans, I can't just start scanning it to figure out how to break into it.
In the very worst case, my attack has been slowed down, which gives you more time to discover me. If you are monitoring your network, of course.
Reality is, in today's world, with the growing internet of things and the pervasiveness of "bring your own devices" that you can't stop the penetrations. You simply can't; it WILL happen. Therefore, you design your systems for security. Segregation and separation. Cofferdams. Barriers. Walls. Monitoring. And local firewalls are certainly part of that.
If you wish to be HIPAA and PCI compliant - and in today's world, you really want to be - then you'll do these things. When (not if) your network is cracked, the damage will be limited, you will have time to identify the penetration and kick the attackers out, and your customers, your employees, and your trade secrets will be safeguarded.
