Does it block access within the same group by default for the lateral motion case? That would definitely help somewhat, although it's certainly too common for people to have allow-all rules for internal traffic.
has no one replied that any VM that handles HTTP(s) traffic MUST open ports to start functioning, and is therefore fully vulnerable? what am I missing here
Opening http(s) ports != opening all ports, or even the ones that the management services run on
Open ports to webservers like Apache,nginx etc. aren't affected by this issue.