Bob, a system administrator at TPNQM SA, concluded one day that a DMZ is not needed if he properly configures the firewall to allow access just to servers/ports, which can have direct internet access,

This is incorrect because a stateless firewall can still filter traffic between network segments using ACLs based on source/destination IP and port, making DMZ segmentation viable and beneficial even without stateful inspection.

Filtering by destination IP alone does not provide network-level isolation - if a public-facing server in the same flat network is compromised, an attacker can still reach internal workstations regardless of firewall rules.

Bob is entirely wrong on both points. A DMZ provides network segmentation that limits the blast radius of a compromised public-facing server - even a stateless firewall can enforce ACLs between DMZ and internal networks, providing meaningful isolation. Relying solely on firewall rules without a separate DMZ segment leaves internal workstations reachable from servers that have direct internet exposure, violating the principle of defense in depth.

DMZ is relevant regardless of firewall type because its primary purpose is network segmentation, not stateful connection tracking; a stateless firewall can still enforce the boundary between a DMZ and the internal network.