This topic is here solely to offload the VLAN-related one from the firewall discussion.
@anav, connection-state=new is just one of the conditions which the packet must meet to match the rule. The logical operator among all rule conditions is always "and" (whereas if the condition says field=value1,value2,value3, it in most cases expands to (field=value1 or field=value2 or field=value3) - this is related to connection-state, addresses and ports, in exceptional cases, it expands to (field=value1 and field=value2 and field=value3) - I actually think the only case like this is the tcp-flags field.
The rest is more or less a matter of algorithmic programming. If you have
action=accept chain=forward connection-state=established,related
at the beginning of your chain=forward of /ip firewall filter, any packet which got past the second rule must have one of two remaining possible values of connection-state - new or untracked. Those belonging to already established connections and those related to established connections have been accepted already by the first rule, and the invalid ones have been dropped by the second.
Now if we forget for a while about untracked, rule 3 and further are your "administrator's quest", made to handle only packets matching connection-state=new, in another words the initial (first) packets of each tracked connection. And as only packets matching connection-state=new can reach rule 3 and the following ones, it is not necessary to evaluate that condition in each of those rules as doing so consumes some CPU cycles. However, for clarity of reading, adding it there may be beneficial, and that's probably why @pcunite prefers to spend those few extra CPU cycles - only once per each new connection so not really much in total.
Of course, if your 3rd rule would contain only the condition connection-state=new and it would have action=accept, it would make the firewall wide open, but that's not the case there.
Once this becomes clear, we may spend a few words on connection-state=related and connection-state=untracked.