The Windows firewall does have SOME outgoing traffic protection under Windows XP.
Windows Vista and 7 have very different firewalls that may seem more advanced (and they are in some ways), but they have one fatal flaw: there is no way to have it ask for internet access if an application needs it. It either blocks everything (with static rules for exceptions) or it allows everything (the default setting).
Other than that, incoming protection is pretty much done properly by both firewalls. For Windows XP and 2003 though, I HIGHLY recommend Sygate Personal Firewall (http://filehippo.com/download_sygate_personal_firewall/). Now bought and killed off by Symantec, it is the only, and best possible firewall in many ways, it is free, offers any possible configuration you could ever want, and it'll ask for permission on ANY process that could ever use access. Ping? Request for access. Windows share? Request. Windows services? Request. Chrome after an update? Notification that the executable has changed, request for access. You'll love it.
For Windows 7, I can't recommend Comodo enough. It seems to be the only competent firewall that fully replaces the built-in Windows one, and fills pretty much the hole Sygate left behind.