It may not be able to actively worm its way through a good firewall, but who's to say an infected USB stick, user downloading cursors or smilies, or other vulnerability would drop it in past it?

The issue then, is whether the botnet admin would recognize the luck\value of a select machine with inside access, or if it would go unnoticed.