Port 21 and 554 open - why?

If you create a virtual server on port 443, only packets matching port 443 will mach this VS. a virtual server listen on a specific port, all other ports are not handled by this virtual server.

when you create a virtual server, it create another object named virtual address. Are there multiple virtual servers sharing the same virtual address?

Do you have a firewall in front of BigIP?

if yes, is it configured to allow these ports? is it working as application proxy for these services?

Can you try the same map scan from a host connected on the same subnet as the virtual server address?