> These things are designed for use by people running them on servers that are not directly exposed to the internet.

Just as well internal attacks and fraud are never a thing, and pivoting attacks up a chain of successively less secure components never happens.