Your firewall will have some open outbound port, and the bad guys will find and use it. You can usually tunnel out over port 443 (HTTPS), or if not, you could hide in HTTP messages relayed through a proxy server. Heck, the PositivePRO VPN product does (or, at least, did) this.
Your server might have an outbound firewall rule, and the bad guy might be able to disable it or get around it, depending on how badly owned you are (and keeping in mind that you can make the case that there are no "degrees" of owned - you are or you aren't).
Why shells? Well, you can generally do anything from a command prompt that you can do from a GUI, and usually more. They're also faster and lighter-weight than, say, tunneling out a graphical app via RDP. They can be easier to hide on the box as well, and have a smaller memory and CPU footprint.