That allows attacks comes from another compromised device or TCP SYN packet that uses unusual routing. We've already seen Javascript based attacks that use the browser as a gateway to the LAN.

You need strong authentication and secure (proven input recognizer[1]) code in anything that connects to any network, even a guaranteed LAN. Border security is only one layer of protection, and LANs are rarely an isolated network.

[1] https://media.ccc.de/v/28c3-4763-en-the_science_of_insecurit...