My guess is most cases where this happens the developer don't know the server is public. I've seen it happen at past companies where DB/Services were accidenta

My guess is most cases where this happens the developer don't know the server is public. I've seen it happen at past companies where DB/Services were accidentally configured on AWS with a public IP and VPC wasn't set up correctly to make it more explicit when exposing public services.