Currently you can configure Samba in such way, that you set open port in
firewall for Samba with no Samba running at all.

Please move this from global settings, to settings of Samba process itself --
so instead of "open this port and leave it hanging" (current approach) make it
"let samba open this port".

In the second approach, when no samba is running, port is closed (because no
party opened it). When the samba starts, it is authorized to open port in
firewall (or not, depending on the setting), so it opens it (or not), and when
the server the port is closed (or unaltered).

This way such odd states, and open port + no samba running, is not possible, it
is not a bug per se, but security issue for me.