With passive FTP both the control connection (by default on port 21) and the data connection (to the PASV port indicated by the FTP server) are both initiated by the FTP client. Typically firewalls that allow their users to set up a FTP connection to a remote server will also allow the client to establish that associated data connection.
Many larger sites don't allow their users to directly connect to the internet at all and require the use of proxy server for all traffic. The passive port range may or may not be a problem for those users...
More uncommon is a set up where users are allowed to connect to the internet directly, but only to a limited number of ports, e.g. 80 and 443 for web traffic and other ports are blocked by default.
In that scenario any slightly advanced firewall can be configured to allow the protocol FTP and will load a specific helper module. The firewall opens port 21 for FTP control connections and will inspect the control traffic for the PASV port that is assigned to a FTP client. Dynamically that passive port will opened in the firewall allowing the data connection to be established (but only between that client and that specific port on that specific FTP server) and that permission will be revoked when the control connection is terminated.