FTP server is a security risk. If you have to do it, read all documentation carefully. Especially if you are allowing annonymous access. The severity of these exploits ranges from susecptability to denial of service attacks to root exploits. In particular anonymous FTP servers are vulnurable as they allow limited access to anyone.
Some exploits require that the attacker have at least anonymous access.
Not every access to port 21 is part of an attack. For firewalls, the trouble with FTP starts as the file is transmitted. One would assume that the server will send the file from its port 21 to the remote port from which the client connects, similar to the way web pages are sent by the web server. One would assume wrong. Instead, the FTP server will establish a secondary TCP connection.