and all those things are another OS which you have zero visibility or control, but have to manage just like a production server. there's probably tons of ipmi backdoors all over the place and nobody cares much besides limiting routing to some lan.