Even though most of these probably have read only access, the fact that its even there shows that the person that set it up didn't have security on their mind.

Even though most of these probably have read only access, the fact that its even there shows that the person that set it up didn't have security on their mind. Sure you may not be able to do anything via VNC, but what about other attack vectors on these services? Are they updated, is the os up to date, is it using easy usernames/passwords so you can ssh in for example?