Does this mean that their testing servers can access production db over network? That's something we specifically put under control so that even a misconfigurat

Does this mean that their testing servers can access production db over network? That's something we specifically put under control so that even a misconfiguration can't cause this. I'm surprised an audit didn't discover that.