Exactly, they aren’t exposed outside. That’s why you can “potentially” add rules to route request from the outside to an internal host:port, even 80/143. On the LAN you would still able to connect to router admin.