It's still surprising... I've used MongoDB a few times, but I was always well aware to put it behind a firewall and setup basic auth.

I'm not really one for super fine grained security at the database level, but you should at least have some level of connection controls in place.

iptables isn't that hard.