If the Mac Firewall is On then if Messages is allowed then all processes linked to Messages are also allowed.
However if you are using something like Little Snitch that monitors and tells you what connections the Computer is trying to make (you tend to have to either set them up or allow on a one by one basis).
These tend not to link the
IMRemoteURLConnectionAgent which deals with the Messages app login
or the IMRemoteURLTraferAgent item that is only in use when files (and therefore pictures) are Transferred.
AS the names don't have Messages in them it is possible for people to dismiss the request as it does not look "right".
Another reason can be the DNS servers being used.
The Login server is called init-p01md.apple.com
Some DNS servers seem not to be able to find this.
Again it changes for Transfers
Adding Free Public DNS servers to your router can help
Free and Public DNS Server List (Valid November 2017)
The Google ones tend to be popular.
Some people choose to also add then you their Mac in System Preferences > Network > Connection Method > Advanced Button > DNS tab
8:45 pm Thursday; November 16, 2017
iMac 2.5Ghz i5 2011 (Sierra)
G4/1GhzDual MDD (Leopard 10.5.8)
MacBookPro 2Gb (Snow Leopard 10.6.8)
Mac OS X (10.6.8),
iPhone 6 iOS 11.x and an iPad (2)