I might be mistaken, but there seem to be two benefits at work here.
First of all it does seem as if it act as an added layer of defense for the entire network (or just providing a firewall rating of 2 for the weapon itself in case the weapon is not part of a PAN) against hacking attempts. But it doesn't seem as if it's firewall would be accumulative with other weapon commlinks firewall (no getting 10 weapon commlinks in your PAN for a total of +20 firewall shenanigans).
In addition to this it seem to act as an added layer of defense for the specific weapon in question, soaking up matrix damage that would otherwise hit the weapon. This protection does not seem to apply for the whole PAN or all devices in the network, only for the weapon where the weapon commlink is installed.