Thanks for the pointer, Charles. I hadn't seen that before.
I remember that the ipfire install instructions specifically warned against using the WAN port for anything, because it bridges all the others. But it didn't mention the LAN ports being bridged to each other.
Practically speaking, it'll be behind the firewall built in to my cable modem, and will be on all the time. I could unplug the WAN when booting. But the USB Ethernet adaptor is a good idea too. I don't even need Gbe. My testing showed a peak throughput of 90 Mb/s, so the 100 Mbe adaptor I have lying around will do fine (as long as ipfire has a driver for it). My internet connection is 150, but some things (like my Roku) will be bypassing my firewall and feeding directly into the modem.