So how would this play out differently if an exposed Elasticsearch cluster was connected to an endpoint different from IoT?

The problem is neither IoT nor ES - whoever built this just didn't bother to implement even basic security.