Theoretically, if there aren't any problems with the authentication mechanisms of the website and it is implemented securely (using an SSL connection, no flaws in the implementation that can be exploited, etc) then it doesn't matter. That said, that is a BIG if.
It would be safer to remote in to the company through an already existing gateway, but if there isn't an existing gateway in, and depending on what the firewall is responsible for (if bypassing it wouldn't result in exposing the internal network from the outside, but only allowing things from the inside out), it could potentially be safer to administer the firewall this way than open up a gateway in to the entire network (since a VPN could potentially have a similar vulnerability.)
If the firewall being down would allow external attackers in, then it's no more safe than the VPN being added since a compromise would give access to the internal network. A VPN probably has a smaller attack surface area, so it's probably safer in that case.
Either way, he better be sure to put a lot of security in to the credentials for remote access and have them lock out quickly if a brute force attack is attempted. It would probably even be worth using a certificate based authentication as well since it is pretty much the keys to the kingdom. I wouldn't personally want to put such functionality on the Internet, even behind a secure portal, unless I absolutely had to.