DEP isn't about preventing a bad program from doing something bad, it's about preventing a bad program from exploiting bugs in good programs and doing something bad. (Address-Space Layout Randomization (ASLR) falls into the same category)
It functions by allowing a program to tell the system, "Hey, you see this memory section over here? This is data, not code. This should never be executed. If you catch me trying to execute it like code, terminate me immediately." This makes it safer for trusted programs to work with untrusted data, because the memory where untrusted data is stored can be flagged, and if malicious data tricks the host program into trying to run this protected memory, the CPU can immediately raise exception to the OS and the OS can terminate the program before it can be taken over.
Disabling DEP will allow malicious code to execute buffer overflows, heap overflows, and stack smashing attacks in both the kernel and application programs.
Your programs will continue to work, but they will be vulnerable to being taken over and exploited by malicious code. It would be possible to "break out" of a sandbox, or take control of your firewall by sending it a malicious stream of packets, or for a website to take control of your webbrowser.
Sandboxes and VMs work by using a trusted program to monitor and filter untrusted code, carefully ensuring that the untrusted code doesn't do malicious things. DEP is one of several important features which prevent the untrusted code from taking control of the trusted program, and doing things while masquerading around as said trusted program.
Moreover, DEP has been around for 6-8 years, so it's not something new. I would expect most applications under active development and especially anything billed as security to have supported it long ago, and I would have serious trouble trusting anything that doesn't. There's a reason Microsoft finally switched to forcing it on by default in consumer versions of their OS, and it's already been defaulted to 'On' in the server editions for some time.
Call JPF's support and complain about their terrible, out-dated security. The Windows Firewall isn't spectacular, but hopefully it'll get the job done until they can fix their product. Either you end up with the firewall you want, working properly, or you learn that you really shouldn't trust them with anything security related.
