IMO, passing the leaktests, is nothing to a good firewall.
They not that important.
Main thing is inbound protection.
If you run some firewall, hard rules to make to make it working.
Then somewhere on the way, bad rule or allowance also to make?
You make that one? You do a bad rule?
It is just, bad rulemakers and bad behaving firewalls

So my advice is for your folks to stick to what firewall forks for you, and forget the leaktests ;(