Could you explain why you think wide-open-dev-machine.customer.com is NOT safer without AXFR (assuming it blocks robots, and the web server only serves the site for "wide-open-dev-machine.customer.com")?
I'm just trying to understand how it could not be considered beneficial in any way, however much (which is what you're claiming).
wide-open-dev-machine isn't safer because there's a whole variety of ways to learn about it without AXFR.
For what it's worth, I would not flag a customer for running SSH on port 22; I would certainly flag a customer for having port 22 exposed where it didn't need to be; for most SaaS/ASP-type companies, I'd flag them for having more than one SSH port exposed, and I'd recommend that they invest in a VPN instead of exposed SSH.
Could you explain how you would learn about wide-open-dev-machine as simply as by using AXFR in your scenario (you aren't on the network, so no *casting).
Edit: "so what possible reason could there be for enabling it?" is eerily similar to my message :)
imageshack.com
about.com
ehow.com
sparkstudios.com
yfrog.com
liveinternet.ru
pgmediaserve.com
wikimedia.com
adfly.com
thefreedictionary.com
amung.us
btjunkie.com
bluehost.com
drtuber.com
ero-advertising.com
autohome.com.cn
exblog.jp
inetglobal.com
milliyet.com.tr
imagebam.com
naukri.com
bigpoint.com
altervista.com
hypergames.com
gsmarena.com
excite.co.jp
admagnet.com
macrumors.com
linkbucks.com
cracked.com
traidnt.com
radikal.ru
paper.li
eluniversal.com.mx
wiktionary.org
indianrail.gov.in
docin.com
123rf.com
perezhilton.com
mangafox.com
hostmonster.com
myfreecams.com
giveawayoftheday.com
ultimate-guitar.com
itpro1.nikkeibp.co.jp
pantip.com
hawaaworld.com
120ask.com