tl;dr: security is the issue, users can't be trusted SSH is a 'general purpose' protocol for remote filesystem access. Clients with lax permissions are an atta

tl;dr: security is the issue, users can't be trusted SSH is a 'general purpose' protocol for remote filesystem access. Clients with lax permissions are an attack risk. Non-technical users can't be depended upon to handle permissions. As such, SSH is commonly blocked at the firewall to prevent such malicious access. HTTPS is rarely blocked. HTTPS is inherently safe because it doesn't grant access to anything that isn't explicitly defined the HTTP-layer API. HTTPS connections are usually handled via browsers that come with sandboxed memory spaces; even if a malicious actor manages to establish remote code execution in the client there's little/no risk of compromising the user's OS via a buffer overflow or equivalent attack vector.