It doesn't "bypass your firewall"... it lets you shoot yourself in the foot. You're asking it to open ports without specifying an explicit network interface so it opens them on all interfaces. Which includes opening up the firewall, because what's the point of putting up a service and blocking it in the firewall.

Also, doing it by hand would be incredibly tedious. Docker automatically adjusts the rules to match the ports and interfaces to its private container netmasks, and brings them up or down as needed when the containers start/stop.

All you have to do is bind ports to localhost or to a private interface if you don't want the service to be publicly exposed.

Beginners get bitten by this because they say ports: 9999:9999 instead of ports: 127.0.0.1:9999:9999/tcp like they should. Unfortunately most examples out there use the terse version and never explain why it's bad.