If you enable it in /etc/rc.conf, pf will be loaded as a kernel loadable module (like doing kldload pf). This isn't necessary when it's compiled into the kernel. The only possible advantage I see is that an attacker who manages to escalate to root privileges could manually unload the module. This is, of course, a moot point if you think about it for a second.
