I suspect that this is because when the data traffic is initiated from the outside the necessary session is not created for the traffic to go through the router. We could see that the dynamic access-list was there of only a brief moment and then it disappeared, which is the correct behavior if the session was never established.
With the passive FTP both the data and control session is initiated from inside the router and that makes it easier for the firewall to create and maintain the sessions as well as opening the ACL.
There are two things that we could try and both are to see if we can possibly help the sessions to be created for the inbound connections.
1. Have the ip inspect going both in and out on the outside interface.
2. Configure ip inspect for TCP.