what? who said anything about exposed ports? almost all debian distros come preconfigured with iptables to only allow traffic for http and certain other services by default. any port that is not part of this default standard will need to be opened by the user/root. no firewall needed at all as the system is a firewall of sorts.
anyway, I don't like pulse-audio either. had to remove it from a couple of my systems before to get working sound. lately I didn't have any problems with it anymore, though.
security wise I'd rather be worried about systemd. not that it does anything bad yet, but it's super overcomplex, manages way too many aspects while it should be doing a simple job. it's becoming a kraken.