I replied in another comment, but letting third parties connect widens the surface area of the potential attacks. If that bug happened in a third party, from a

I replied in another comment, but letting third parties connect widens the surface area of the potential attacks. If that bug happened in a third party, from a security pov you must block them from accessing the service, at which point you need to decide if you want to police every single possible client or focus on one and make it widespread.