It's pretty silly how many services are public by default when ideally they should only listen on a unix domain socket (or nothing) until you configure something else.