Question about Firewalls being on the outside of a network

[Big Evil]

At the end of the day - a ASA (or other) can be the CE.
For example if you have a leased line/EFM of any other Ethernet link/circuit.

The ISP will create a P2P (/30) and a static route with your subnet's pointing to the IP on your CE. In return you create a default route on your CE via you interface/IP and on the ingress/LAN interface you add the subnets your ISP has given you. Very basic, we all know this - a FW can do this.

If you have a single link from you provider this is easy, the harder part come when you are multihomed - but even then not that tricky.

HTH