We don't for example for firewall logging levels or firewall policies
like DROP, REJECT, ACCEPT. Also having the default as a placeholder
automatically is, if nothing else, convenient. tbh, I'm not super sure
how often we do this, so may not be warranted to have a general thing if
only these two end up using it.

Good example. I guess a good UI would explain the difference between DROP and REJECT:

DROP => Silently discard the packet.

REJECT => Reject packet and send an error message back.

Just write a small helper (combobo_from_schema(..)).
If it turns out to be useful, we can still add it to the schema helper.