Comment by anonymars

Maybe I'm missing something but doesn't this very story cut your assertion off at the knees?

With a VPN the attack surface of this vulnerability would have been miniscule compared to a publicly accessible zero-day RCE

(And it's not like you have to allow carte-blanche access behind the wall)

Defense in depth!