We normally say port 80 is firewall friendly.
Firewalls can be used to filter both incoming and outgoing connections. While in the simpler use case firewalls are only used to filter incoming connections, in more restrictive environments they also restrict outgoing traffic, i.e. what kind of external services can be reached from inside a company.
The phrase "firewall friendly" has to be seen in the latter context. It means that while almost all outgoing traffic is denied (incoming anyway, unless it is a response to outgoing traffic), visiting external websites from inside a company is usually allowed. This means access to external port 80 (http) and 443 (https). With simple packet filter firewalls it also usually means that no additional restrictions are applied to port 80 and 443 and even more complex firewalls with content inspection (i.e. DPI or proxies) usually only apply a blacklist which sites/URL's are forbidden but still allow outgoing web access in general.
Because this kind of port based restrictions is common enough in corporate networks and even with many public WiFi hotspots, most communication on the internet now tend to work over HTTP/HTTPS or at least use HTTP/HTTPS as fallback in case they notice traffic restrictions. For example Skype usually uses a wide range of UDP and TCP ports but can fall back to a tunnel via HTTPS if these ports are blocked.
But can hacker just hack into port 80 via TCP or UDP message?
Taking into account that the meaning of this phrase means that incoming traffic is denied (unless being a response to outgoing traffic) and outgoing traffic is restricted to web surfing, then it should be clear that it is not that simple to "...just hack into port..." from the outside. And given that the meaning applies to web surfing it also applies only to TCP since UDP is in restrictive environments blocked both for incoming and outgoing anyway.
But what actually is done by attackers is to use outgoing traffic on port 80 and 443 for C2 (command and control) communication and data exfiltration once they've managed to infiltrate a network (for example with phishing mails or drive-by-downloads).
And what is also done by attackers is to make users inside the company network visit a site which delivers malware. This is for example done by infecting sites the user commonly visits (watering hole attack) or using targeted advertisements (malvertising). Similar the attacker might make the victim provide login credentials by luring the victim (typically using phishing mails) to sites which mimic common services the victim uses (i.e. Paypal, web mail, Netflix...). Given that mostly unrestricted access is allowed on port 80/443 it means that the firewall will not block these kind of attacks.