It's not the sysadmin but the app/dev that is setting the port. When they do that, they are not intending for the public at large to find it easily and use it a

It's not the sysadmin but the app/dev that is setting the port. When they do that, they are not intending for the public at large to find it easily and use it and services like that get less attention and care. A lot of data breaches happen for example by elastic's restful api being exposed because people don't change the defaults.