Some firewalls, Application Proxy Firewalls in particular, can even tell if you are sending malformed packets on an authorized port/protocol.
Execpt that the majority of programs pick a semi-random outgoing port on the local machine to talk to a fixed port on the remote machine. A single FTP session can end up using a different outgoing port for each file it transfers (got to love the ability to upload more than one file at a time) using thousands of different ports in the process.
A hardware firewall has no knowledge of what happens at the application level, just that it sees FTP traffic going out. It doesn't know if it was send by ftp.exe or spyware.exe, and will do next-to-nothing to protect you once you're infected.
(Other than that it can prevent the malicious external machine from communicating to the virus and giving it instructions -- but if the virus has a predetermined to-do list, the hardware firewall won't stop it once it's active)