I had forgotten about BGP. Telnet and administrative access should be on it's own private LAN. I really cannot picture anyone administrating a large router, via telnet, over the public internet.

Ports don't need to be open on the router in order for it to route packets.