The firewalls you mentioned were NAT/Enterprise level. They do not generally have absolute control of what programs are running on one of their internal computers. May be that port left open is used by a C&C client installed on one of the user's computer inside LAN, hereby possibly compromising the whole internal network. There is a reason why DMZs exist.