That's true. A firewall won't protect a vulnerable webserver. Still, if ports other than port 80 are open then perhaps this is further evidence that the people running the servers weren't taking security as seriously as they should have.