Software firewall is mandatory to keep your average lookyloo's at bay, however they're already on the machine and can drive up the CPU and usage, not to mention the dDOS with just TCP requests.

With the hardware firewall you can stop the intrusion before it ever reaches your machine. Null route their connection and you no longer have to think about them (on the machine level). It's then into the DataCenter's hands to find the inflow of traffic and cut that off. You at that point are no longer contributing to the problem.

As stated, all datacenters have some form of hardware firewall - some go two or three levels deep before getting to your machine. Some of the depth that you will want to go to will depend on how exposed you are as a site on the web.