It won't matter if they are all behind a single router/firewall because nothing will be able to get to the local network unless you explicitly open a port in the router to one of the machines. So if you don't open the ports that Windows Networking uses you are safe. Now that doesn't help you much in the event that someone gets a virus that then proceeds to use vulnerabilities in Windows Networking. In the case where you have a very large network that you want to secure you can set up a domain system that will not list what is being shared and require that you authenticate to access anything. It is possible to lock down a Windows Network but it just isn't that way by default for convenience (a good thing IMO).