But ipmi cards are little network-attached linux boxes which run prehistoric kernels and userspace, exposing as many services as the half-wits who put together the firmware image can shovel in, and are rarely if ever patched by the vendor unless there's some really public scandal.
The standard thing to do is to isolate them on some kind of private management network in an attempt to shield the wider internet from the full majesty of the firmware engineers' dazzling skills, but that might be harder to do in the simple 'beginner' scenario Rachel describes.
One good simple version when you get up to two servers instead of just one is to cross-connect so each machine has ipmi access to the other, but neither ipmi service is exposed to the wider world.
I bet your provider has something like that. It's a godsend when you screw up, say, the hypervisor running state somehow and need bare metal access to unbork it :)
But I expect you're probably right some or all of the providers we use do have something like that, as I speculated in the previous post. I've just never understood the point of vga-type stuff when bios/uefi serial redirect exists and serial console is more convenient anyway once the kernel has started, so never asked the question.
I've often wondered about actually replacing the kernel and userspace on the vendor BMCs themselves, to substitute something more competent, but I've not found anyone who's successfully done it.
As this document focuses on keeping things simple, they don't have the isolated network / VPN needed to use IPMI.
The equipment is all Dell with Enterprise DRAC, which is 90+% of my remote power needs. The only times I've needed to physically unplug them I also needed the power button on the machine held down for 30 seconds as part of what Dell calls the "FLEA drain" process, so remote power strips wouldn't help.