Nobody's actually still exposing rails sites to the internet are they? I mean except as a honeypot.

The rails team's approach to security (it's the application's problem) has been consistent. At this point if you're letting the wild Internet touch your rails apps it's probably your own fault.