I'd say that the open ports are indeed a security problem. Somewhere in the AEBS setup (where, I don't know) there should be options to open or close various ports. It looks like everything was "stealthed", with two ports being changed to "closed" and the three in question simply opened. Right now I can't find the documentation on the AEBS or the AirPort software to even begin to look it up.