I agree that it's highly unlikely to be a deliberate action, but your listed mitigations would only help against security issues that impact the web services.

It could be the only way to go in the highly unlikely scenario that attackers are able to compromise the management APIs of various infrastructure devices like routers, baremetal servers etc.

These APIs are usually on airgapped networks though, which makes this extremely unlikely