For one thing a lot of BMCs are not the easiest to secure and at least KVM devices like a Spider or PiKVM can be patched so that these network accessible devices aren’t so easy to own remotely. A number of BMCs can start advertising and routing to itself across different PHY so even not hooking up the management NIC to a separate LAN won’t be enough then (you’d need to have the right settings and hope you can disable this behavior to avoid such a broadcast across other NICs). I have this issue with my ASRock ASpeed BMC and never got around to fixing it but it bothers me a bit every time I see the IP pop up in my DHCP list and ARP tables.