Just my thoughts - there are situations where rp_filter is not sufficient, and it was not clear to me how to do this cleanly with the zone firewall, so I ended up hacking a few iptables commands in rc.local instead.

Consider a multihomed BGP setup, like the one I have here, where asymmetric routing is possible so rp_filter not useful. I want to filter out incoming traffic with spoofed source IP addresses that appear to come from inside my network, but actually arrive on a subset of interfaces that connect to the upstreams. Set of prefixes to match is easily configured by a few "set firewall group network-group $group network $prefix" lines which translate to an IP set, but I haven't figured out the easy VyOS CLI equivalent of:
iptables -t raw -I PREROUTING -i $iface -m set --match-set $group src -j DROP

I only care about incoming interfaces (one such rule for each upstream interface over which BGP runs), no matter where the traffic goes to (outgoing via another interface, or destined to the local router itself). I've recently learned that improving Source Address Validation on the Internet is the subject or at least two experiments mentioned below, it should be made easy to set up.

https://imaal.byu.edu
http://drakkardnsv4.com

Both seem to work in a similar way - send a DNS request with spoofed source address asking about a domain they control, and see if they get a request from a vulnerable DNS resolver.

As a side note, I was hoping ipset would support checking against a list of network interfaces (similar to MikroTik interface lists) - but that's not supported yet. That would allow a single rule to match ingress traffic from a subset of interfaces connected to upstreams (like 3 separate VLANs for 4 separate BGP sessions with the IXP I use). So, for now each iptables rule matches just one interface.