[nijave]

>How is this delay so small if there are really 50 million deny statements?

More a testament to the years of optimization nginx has undergone.

>Is there a reason why they don't use a firewall?

Some other comment said they have a custom error page for blocked requests although I think you could still have the firewall rewrite the destination port and have a listener that serves the custom access denied page there.