There are protocols to ask the CPE (which is where the firewall usually is) to temporarily open a specific inbound port to a specific host, like UPnP, and many

There are protocols to ask the CPE (which is where the firewall usually is) to temporarily open a specific inbound port to a specific host, like UPnP, and many P2P software already know how to use it. So you can have a "deny inbound by default with state tracking" firewall, while still allowing P2P software to work without relay servers and similar tricks.