SD-WAN

not sure i understand your question right or not, your concern is place the EC in front of NGFW and create some security issues. please take note that, whether FW in front of EC or behind EC will have the same secuirty design, as the traffc will pass both FW and EC. and I personally will recommend you to place EC in front of FW:

• most of FW is active standby, while EC supports active/active, if you place FW in front of EC, EC cannot do Active/active, unless there is swtich in between;
• for some site where public IP address is limited, you probabaly only have 1 public IP, you should configure public IP over EC WAN interface, as EC need that for IPsec tunnel; if you place FW in front of EC, you need to configure port foorwarding on the firewall for IPsec tunnel build.
• there will be additional firewall rule need to be open such as UDP port for IPSec tunnel, if FW were placed in front of EC.

I can see how some could argue that a dedicated NGFW like PA might be better suited(more of a proven trackrecord atleast) to "face" Internet than an EC device.

One option might be to put a Palo Alto in L2 mode in front of the EC. That way you may still be able to gain some of the security benefits from having PA face the Internet, but avoid some of the drawbacks from nat etc. since L2PA will be transparent to your SDWAN EC devices.

not sure i understand your question right or not, your concern is place the EC in front of NGFW and create some security issues. please take note that, whether FW in front of EC or behind EC will have the same secuirty design, as the traffc will pass both FW and EC. and I personally will recommend you to place EC in front of FW:

• most of FW is active standby, while EC supports active/active, if you place FW in front of EC, EC cannot do Active/active, unless there is swtich in between;
• for some site where public IP address is limited, you probabaly only have 1 public IP, you should configure public IP over EC WAN interface, as EC need that for IPsec tunnel; if you place FW in front of EC, you need to configure port foorwarding on the firewall for IPsec tunnel build.
• there will be additional firewall rule need to be open such as UDP port for IPSec tunnel, if FW were placed in front of EC.

Why put a PA in front In L2? 

ECOS v9.2 has been certified by an external party (ICSA) and can certainly withstand attacks on it. It is just more $$, complexity and management. The basic security is there (ZBFW, IPS/IDS), the content inspection can be done elsewhere.

I can see how some could argue that a dedicated NGFW like PA might be better suited(more of a proven trackrecord atleast) to "face" Internet than an EC device.

One option might be to put a Palo Alto in L2 mode in front of the EC. That way you may still be able to gain some of the security benefits from having PA face the Internet, but avoid some of the drawbacks from nat etc. since L2PA will be transparent to your SDWAN EC devices.

not sure i understand your question right or not, your concern is place the EC in front of NGFW and create some security issues. please take note that, whether FW in front of EC or behind EC will have the same secuirty design, as the traffc will pass both FW and EC. and I personally will recommend you to place EC in front of FW:

• most of FW is active standby, while EC supports active/active, if you place FW in front of EC, EC cannot do Active/active, unless there is swtich in between;
• for some site where public IP address is limited, you probabaly only have 1 public IP, you should configure public IP over EC WAN interface, as EC need that for IPsec tunnel; if you place FW in front of EC, you need to configure port foorwarding on the firewall for IPsec tunnel build.
• there will be additional firewall rule need to be open such as UDP port for IPSec tunnel, if FW were placed in front of EC.