Q: How can I tell if my Mac has been compromised if my firewall was not turned on?
A: A firewall is only a small part of an overall penetration/compromise prevention program.
In the case of macOS, the firewall isn’t terribly vital. With the firewall off, you would still require an active process (application) waiting for and responding to commands coming in from outside the computer. If you have file sharing, screen sharing, remote login, remote management turned off in the Sharing System Preference, you probably don’t have any apps that can respond to criminal attempts to gain access.
But back to the question how can I tell if my MacBookPro has been compromised? Someone who does quality hacking won’t be seen. You would need to pour over the system logs to even have a chance of noting their work. Someone who is not highly skilled will usually leave your system unstable, or visibly changed.
