He's probably referring to hardware vs. software.
View from above
Yes to a certain point all hardware firewalls are software but given the right hardware you can reprogram the hardware. That is usually quite an expensive operation but once the hardware is reprogrammed the firewall can operate at line speed.
Performance in Linux
We had a DDOS attack on one of our sites with a GBit uplink. Under normal circumstances we were perfectly able to deliver nearly at wire speed. The attack however was a simple SYN-Flood and we couldn't take it.
The reason was a "crappy" card with only a single receive queue. That meant the only a single core was used by Linux to get the packages from the card. This resulted in a single core running at 100% usage which was too slow to process all the packages. So the servers behind the firewall were all bored but the one single core was maxed out (Yes we had SYN-Flood protection on, but since there were just to many incoming packages to the card -- before Linux even knew about it -- we couldn't take it)
Once we upgraded the hardware (only the network card, not anything else in the server) to a network card with more receive queues we saw more cores getting used and that was enough for our case. Hardware was (IIRC) 16 Cores CPU wise, 8 queues on the network card. All of a sudden we had 8 times the performance and that was enough.
That being said:
There's nothing you can do against a sufficiently large DDOS attack -- we were just lucky that it wasn't larger and the new setup could take it.
I'd always go for a hardware firewall if it implies better cover-your-behind: Leaving the technical specs aside it's just a matter of risk management. Get any Cisco/Juniper/whatever hardware and a decent support contract and you'll have someone to call who has to fix the problem or pay for the losses in case it doesn't do what was promised. Of course you'll need to get the budget for such a thing, but at a certain point the money for the investement is likely to be a fraction of what the expected income is. Also having a support contract and someone else to blame is a nice cover-you-behind tactic :)
EDIT: Missing if in the last paragraph.