I'd say it's bad design to have everything important in the open just because it's behind a firewall; it's got a huge blast radius when something goes wrong.

Securing your services regardless of where they are in the network should be go the go to