FortiClient 7.0.9 defender popup on first vpn connect.

well, at least this version doesnt auto force reboot; i'm getting a windows defender popup upon installation. I can push out the firewall needs via GPO to get rid of the popup, that users can't allow anyway. I'm just wondering why forticlient thinks it needs all ports inbound. What's the use case? what breaks if i keep it deny all inbound, which is what happens if the user clicks cancel.