Could also be a compliance thing where they were told "If it's not on the form, don't implement it". And it's up to the requestor to specify everything they want opened. Having the network team second-guess what was requested could leave unwanted security holes when they have to make assumptions about a request.

Though I don't understand the problem you experienced -- HTTP runs over a bidirectional TCP connection, if they got your request, then packets for that session were already flowing in both directions (the TCP session wouldn't set up otherwise). The only way I could see what you described would be if they had a proxy or some sort of deep inspection firewall in the middle that was blocking the return response.