You're correct, they shouldn't be. All BMCs, iDRACs and other OOB management endpoints should be on segregated networks with access control. Basic network hyg

You're correct, they shouldn't be. All BMCs, iDRACs and other OOB management endpoints should be on segregated networks with access control. Basic network hygiene. Unfortunately, there are enough who think this is 'inconvenient' (someone literally told me this yesterday) or simply don't know they should, so you find them exposed all over the place.