TCP 19009 is a documented Check Point management port used by SmartConsole and related administration traffic. It is part of the management plane, not the firewall data path, so it carries commands and control sessions used by administrators to configure policy, review objects, and manage security devices.
It matters because management ports are high-value targets: if an attacker can reach them, they may gain a path toward administrative abuse, policy tampering, or deeper compromise of the security stack. Defenders usually restrict TCP 19009 to admin networks, jump hosts, or other tightly controlled sources, and monitor it for unexpected exposure. In real attacks, services like this are attractive because they can provide direct access to the console behind the perimeter, making one open port more dangerous than many ordinary service ports.