Thanks for the suggestions, will give those a try.
The other thing I tried was swapping out one of the AC87U's for an older N56U I had laying around, also running Merlin and configured the same as the AC87U. The ftp connections ran normally over the N56U. So it must be something specific with...
I have two RT-AC87U routers running Merlin 384.13. They are both blocking all ftp connections (from my laptop & webcams) to WAN ftp servers in the cloud. Oddly, I also have two RT-AC68U routers running 384.13, configured exactly the same, and they are not blocking ftp connections. I am at a loss...