plasma-firewall ufw firewalld

Plasma-firewall can configure either for you. As ufw is default installed then I think it will configure that. You can use gufw in GTK based desktops.

You can experiment by adding a deny rule to a high port, apply it then run:

sudo ufw status

I think you will see your nww rule

"As ufw is default installed then I think it will configure that."

Plasma-firewall installs both firewalld and ufw by default unless the --no-install-recommends flag is used.

There are two potential issues.
1) The plasma-firewall package page lists ufw OR firewalld, not both. But both are installed when installing the package.
2) Installing the kubuntu-desktop package installs plasma-firewall, which results in firewalld being installed. Firewalld isn't installed by default in the Kubuntu installation, so there is a mismatch. Perhaps the kubuntu-desktop package isn't supposed to replicate a Kubuntu install?

Should firewalld be removed as a "recommends" package for plasma-firewall? Perhaps change it to a suggests with some sort of conflict check to ensure firewalld isn't installed if ufw is (or remove ufw if it is installed?).

Correction: firewalld is installed only. Not firewalld and ufw.

So ignore question 1) above. There is no conflict.

But question 2) is still valid. Why does plasma-firewall install firewalld instead of ufw, when Kubuntu uses ufw by default?

it might not be the plasma-firewall package that is the problem. Perhaps the kubuntu-desktop package should explicitly install ufw, but do it before plasma-firewall is installed? Would that stop firewalld being installed by plasma-firewall?

The "control" file for plasma-firewall contains:

Recommends: firewalld | ufw

Eventually reversing the order to

Recommends: ufw | firewalld

is more in line with your expectations.

Ubuntu is copying packages from Debian and it seems to me that the Debian package has identical dependencies.
So you maybe better discuss that with the maintainer(s) of that package in Debian.

Debian 11 doesn’t have a default firewall choice. Kubuntu 22.04 does. Installing the kubuntu-desktop package does not provide the kubuntu developers’ firewall choice. Perhaps this should be a bug report on the kubuntu-desktop package.

I’ve created a bug report against the kubuntu-desktop package here:
https://bugs.launchpad.net/ubuntu/+source/kubuntu-meta/+bug/1988802

If the plasma-firewall package is just a copy from upstream Debian then it won’t necessarily reflect any of the Kubuntu developer design choices such as selecting the ufw firewall.