Security is all about trade-offs. When I've used mod_status, I've just used a simple username and password that everybody shared. I've also served it from a different URL than the "well-known" /server-status.

I realise that the IP addresses it shows are not on the order of credit card numbers, and its only the IP addresses at that particular instant (as opposed to historical data or something), but there is a difference between my IP address being logged in server logs and my IP address being visible to anyone who happens to visit a popular website at the same time as I do.

Edit: what I'm saying is, its very easy to keep this information invisible from the open internet. I can see no advantages and only potential problems leaving it open. Given that, it seems like the prudent thing to do is to close it off.

If you worked for the state of California (or an organization that has a policy to follow all CA government code even when it does not technically apply to them) then you have to consider an IP address a "network location" and must treat it as potentially personally identifying information. We only keep IP addresses for 30 days, and try to never share those IP addresses with third parties.

Exposing URLs doesn't seem appropriate.