The cable modem does not have a public IP address of it’s own. They have 10.x.x.x addresses on the Cable ISP’s private network. Only the ZS interface has an IP from the Cable ISP. The firewall is enabled with no rules specified by default. I can show you a screenshot but it looks exactly how every other ZS box looks after being booted up for the first time.
The PC that we type \public IP of Cable connection is outside of our network completely. It is on a computer at someones house using a completely different internet connection.