This is only true after the Mongo people were lambasted on the web for having such a terribly insecure out of the box product. Which was fairly recently. For ye

This is only true after the Mongo people were lambasted on the web for having such a terribly insecure out of the box product. Which was fairly recently. For years the product would bind to all IP addresses. Which is insane for a default install. Feb 2015: Discovered 40,000 vulnerable MongoDB databases on the Internet http://securityaffairs.co/wordpress/33487/hacking/40000-vulnerable-mongodbonline.html http://securityaffairs.co/wordpress/33487/hacking/40000-vuln... The changes were made after this, so we're only talking a few months now.