Sorry, but that's bullshit. Once an attacker is in your organization he will look for exactly that kind of internal-only backend were exploits are already avai

Sorry, but that's bullshit. Once an attacker is in your organization he will look for exactly that kind of internal-only backend were exploits are already available and the attack vector is known. There is no such thing as a internal-only backend regarding security. Let's assume the attacker used social engineering to get credentials from an unprivileged user and uses these to log in to a remote desktop. (I know there are ways to prevent that but I think there are many examples shown that public facing remote desktop is not two unrealistic) Once he is inside your company he can reach the "internal-only" backend and uses the privilege escalation bug you thought is not worth fixing to get root.