When the intention is a debugging server, making it exposed to the world is a mistake and a security vulnerability. At that point it is effectively a backdoor, but the difference between a high level vulnerability such as this and a backdoor is developer intent.

One can read every second week about cases where some backdoor that was meant to be used "only for debugging" landed in the end product and became a security problem.

Actually I usually suspect malice when something like that is found once again, as "who the hell could be so stupid to deliver a product with a glaring backdoor". But maybe there is something to Hanlon's razor… :-D

The difference, in my opinion, is in the documentation and frequency of use. Is it overt? Does the customer really know its there, and what its for?

Perfectly fine to have an access panel that gives you access to the buss .. if the pilot knows you're doing it.

But if its some random entrance in the back of an alley, only 2 or 3 users in the universe know what it is and how to use it ..

*Recently a reputable tech site wrote an article introducing DJI (ostensibly a company needing no introduction) as "Chinese-made drone app in Google Play spooks security researchers". One day later the same author wrote an article "Hackers actively exploit high-severity networking vulnerabilities" when referring to Cisco and F5. The difference in approach is quite staggering especially considering that Cisco is known to have been involved, even unwittingly, in the NSA exploits leaked in the past.

This highlights the sentiment mentioned above: people ask the question only when they feel comfortable that the answer reinforces their opinion.