Nothing requires malware to pick a “strange” port. It could just shove its data into ICMP, or make it look like an SSH connection on 22, or anything else.