At first sight the posted configuration is very unlike the default one that is shipped with SOHO devices, the CCR series are intended for installers/network professionals and have not a (complete) default configuration.
On the other hand the posted configuration appears like being (or intended to be) integrated into a not-so-simple network.
These entries:
/ip address
...
add address= [REDACTED] comment= [ISP] interface=ether12 network=
[ISP's IP]
/ip route
add disabled=no dst-address=0.0.0.0/0 gateway= [ISP's IP] routing-table=main
suppress-hw-offload=no
makes me believe that for some reasons the CCR has direct internet access, and if this is true, running it without a firewall is not safe.
The usual recommendation (for non Mikrotik experts having to deal with Mikrotik devices) is to start from a default configuration of the firewall, see Rule #8 of the Mikrotik Club: