agreed, it's normally in a tightly controlled management subnet, still risk though