Why people expose their core infrastructure on the internet directly and unfiltered always baffles me. I guess they must be SWEs who have never touched a server.
Your viewpoint operates on the assumption that a private network provides additional security in comparison to the public internet, which is a very dangerous assumption to make.