Deloitte _sells_ security consulting and they had DCs on public internet as recently as a few years ago (around the time they were breached).