I believe the point is that you have CoreOS hidden behind a firewall you can control, therefore you only have ssh open to sources you permit, you use a bastion host, etc.
So a Ubuntu server in front of CoreOS works... :D ;) I'm thinking of a small cloud setup like on DigitalOcean were you need ssh into the CoreOS server.