Firewall lets it through: cups-browsed explicitly listens for printers advertising themselves. If it's firewalled off, how can it receive the printer advertisements?

I don't know what default firewall rules are configured, but on distros that run it I'd assume it's allowed through, otherwise no reason to run it.