I completely agree. Without the external ability to directly contact nodes on the inside, an attacker has to either compromise the network hardware, or somehow

I completely agree. Without the external ability to directly contact nodes on the inside, an attacker has to either compromise the network hardware, or somehow deliver a software payload inside the network. It's not a silver bullet, but it does have a strong role protection.