It's because they typically hack web servers, and then they spawn a fresh web server on a random port.

Anything below 1024 requires root access, which can be problematic, and 80/443 may already be used.