I'm not sufficiently familiar with the Windows firewall, but I think it does not allow really fine-grained control but only "Please allow WWW". Hence, it is only suitable for beginners, IMO. But there are more fundamental problems to consider:
If the underlying Windows system has a problem, chances are that both, the firewall and the webserver, become compromised, allowing the adversary to extend his influence as he likes. Especially if they reside on the same machine.
In contrast, you could significantly reduce the attack surface if you deploy a BSD-based firewall in front of the Windows server. BSD has much less bugs/month and the packet filter would be able to prevent the exploitation of bugs on the windows box or at least restrict/monitor communication.
Due to the reduced code base, update rate and bug rate, the BSD box also adds only minimal maintenance overhead once it is deployed. If you have someone familiar with Linux/iptables it may also be worth looking into a specialized Linux distribution, such as Shorewall, or strip down your favorite Linux distribution.