I wonder how much that has to do with human nature thinking "well this is obscure" so then they don't secure it as if it was 'customer facing' or less 'obscure'.... and thus leave it more open than ever.

I knew a place that assumed such things, crazy insecure. They also played the "well this shouldn't be exposed to the internet" game as well.