It's exceptionally common. I've encountered what seems like a wildly unreasonable number of otherwise smart, competent, capable devs possessed of the bizarre be

It's exceptionally common. I've encountered what seems like a wildly unreasonable number of otherwise smart, competent, capable devs possessed of the bizarre belief that having a firewall or NACLs means they don't have to: * Have authentication on their services, nevermind authorization. * Use TLS on their microservices. * Patch their libraries. Or in any way pay attention to security. The egg is a very common network security model.