Reported an 'exposed FTP' that's firewalled to my office IP

Findings list vsftpd on 21 as exposed to the internet. It's restricted to a single source IP in the firewall. The audit seems to have tested from an allowlisted vantage point and assumed open.