Smoothwall / IPCop provide a more configurable firewall, but if you don't need the flexibility, the firewall in the SME is perfectly adequate.
Remember that it's the services that run on open ports which are the potential vulnerabilities, not the firewall per se.
I've only ever had one user become compromised & that was because he'd set the root password to something easily cracked & had ssh running on the external interface.
QED