Why do I need to turn on Firewall? Isn't it always on!!!

Such popup messages are scams, perpetrated by criminals. If you allowed then remote access to your computer, you should consider it compromised and restore it using a backup that predates the intrusion. If you paid them by credit or bank card, contact your bank immediately and inform them of the fraud.

Avoid phishing emails, fake 'virus' alerts, phony support calls, and other scams - Apple Support

When I hadn't any dealings, years ago, with scammers I got burned. They would fix it for $299 and I told the guy that's more than I'll pay. It was dropped to $199 and I agreed. Long story short. He waited three months to contact me JUST to see if everything was running ok. Yes it was. He then went for the kill. He claimed he accidentally put $5000 on my Paypal and would I reimburse him 'cause his boss would fire him. I got ****** and hung up on him. A minute after hanging up on him I called Paypal and there was no such money put into my account. So, Paypal freezes my account and to this day they won't unfreeze it. Moral of the story is don't have anything to do with Paypal come h**l or high water. Learned that if I turn off the laptop it would be gone upon start up.

My biggest concern is how come my Firewall was turned off?

You should be far more concerned if you paid these crooks or allowed them access to your computer.

As for your firewall:

First: no one in the world would know what is going on with your computer. So, they lied.

FWIW, if you have a modem/router (you use Wifi in your home), that firewall is a lot better than the built in firewall on your Mac.