Firewalls do not operate at layer 7 nor do TLS termination.

What you’re thinking of is load balancers. Most of them will do TLS termination. But there’s also plenty of load balancing solutions out there that will forward the raw TCP traffic (AWS NLB, DNS based solutions, and so forth).

But it’s also worth noting that this vulnerability doesn’t explicitly need MPTCP. Just the POC exploit uses that.