WinSCP does not do that. You are probably mitaken by opened local port of outgoing connection. But it is not listening port. Any TCP/IP connection needs to have local port. Its number is assigned automatically by OS.

Why does winscp open a port to listen to? It appears to be a random local port (i.e., launched twice, the port was different). Is this normal behavior? Why should it be?