Confirmed: “...SCCP endpoints use a non-configurable hard-coded range of 16384 to 32767 for voice-only calls.”
https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/srnd/collab11/collab11/cac.html
Also, be careful about changing the port range for SIP phones if you are using multicast music on hold or anything that invokes media using the XML SDK (e.g. paging). The port range is enforced on the source port of transmitted streams AND the local destination port of received streams. This isn’t a problem for a normal call because the phone gets to choose port(s) within the defined range in it’s SDP offer; however, for at least the two use cases I just cited the phone doesn’t get to choose. It’s told what port to open for receiving RTP by CUCM or the XML SDK application server. The phone will NOT use a port outside the defined range - you'll see an error in the console log and the attempted operation (e.g. playing multicast MOH) will fail.
I unsuccessfully tried to make the case that this is undesirable behavior but the BU declared it working as designed. My view was the reason for changing the port range was QoS classification and marking as suggested in the PA and SRND. From that viewpoint it doesn't matter what port the phone is receiving media on, only what the phone sources it from. Your reason actually gives their position merit: firewall rules within the enterprise would care about both directions.
