pf's syntax is much easier to reason about than, for instance, iptables.

I find myself writing tiny little scripts to emit iptables syntax from something resembling a pythonic-pf, just because I make fewer mistakes when dealing with it.