Firewalls for the Small Business

My setup is probably typical of many small businesses: 20 pc’s and a DSL connection. We are using a LinkSys DSL router to connect our office to the DSL line. The box uses NAT to allow all internal machines to connect to the Internet. As far as I know, there is no way to get back in through the router (other than spoofing IP packets). Is there any reason we should look at a firewall or does NAT provide “enough” protection from the outside world?

On a related note, does anyone know of any vulnerabilities in this particular product?