madadam
IIRC in server only mode there is still some minor degree of "firewall" functionality, but it is only minimal, as deemed appropriate by the developers for additional security in that mode. There were some big long forum discussions involving arne from about 2 or more years ago that touched on this subject (amongst other posts).
You MUST still put a full blown firewall between an sme server in server only mode and the Internet. This could be a sme server in server and gateway mode or some other firewall device.