Setting up nginx to proxy to Elasticsearch with HTTP auth on top is fairly trivial. There's a couple of good articles on the web if you google for it. Also, should you have an Elasticsearch support contract, you get access to the Shield plugin which has extensive access control.
But yes, the fact that it is open OOTB is frustrating.
But yes, the fact that it is open OOTB is frustrating.