Basically by default OSX ships with its firewall completely off. Turning on your firewall, blocks most ports except the few that are by default for standard black box mac services. If you turn on enhanced stealth mode firewall, you block pings. Not the entire IMCP protocol, just pings. And nothing else. So you can sync PRNG.
Also there is issues in bonjour's UDP handling which let you consume all CPU resources (pin the processor at 100% remotely, no permissions just UDP spam). Remotely, also bonjour can't be disabled or blocked by the GUI firewall.
:.:.:
A lot of people look at OSX and say, "Hey its a unix, I'm safe." And they aren't. No Unix is safe by default, even OpenBSD requires you watch what your doing.
Mostly, though, I'd say don't panic. Keep OS X updated and you should be fine (inc. Flash if you use it in Safari, and keep rarely-used web plugins disabled by default). Zero-days are always a worry, but you'll never see them coming by definition, so there's not a lot you can do about it...
[Note, I am by no means an expert]
Edit: and, as another poster said, enable FileVault. It's a great, stable and fast (on modern Macs, any slow-down should be imperceptible to the user) protection against casual data theft if someone steals your computer.
Basically never trust a computer to keep you safe on its own, if it promises to its likely lying (or OpenBSD).
Apple has a different task ahead of it because it's responsible for the whole OS stack. A successful model to follow is Microsoft's, they take security patches seriously.
