You get to the engine via http. Also once you've exploited the engine instance / host you can C2 via http. We're not talking about vulnerabilities in http.

There is lots of surface inside the engine, see links in https://news.ycombinator.com/item?id=49441417