That works as long as the database server is kept up to date with security patches. Quite often in production running a security patch is not high priority.

I guess it all depends on using this feature as an additional layer of protection or using it as the only layer of protection.