Im also not an expert but i believe since there Is still an ephemeral DH key exchange happening an attacker needs to actively MITM while having the certificate private key to decrypt the session. Passive capturing wont work

Fedora has firewalld by default but in the desktop version all ports are open by default. Pretty sure the server version only has ssh and cockpit exposed by default