From my understanding, the inherent risk associated with FTP in general due to the insecure login protocol (vs. secure FTP), trump any new risk introduced by passive vs. active mode. Passive does provide the benefit of allowing access that may otherwise be blocked by a firewall.