Yes it should definitely require a capability. Still a risk that some admin-enabled method (like enabling an IPsec VPN) provides a path to it, but would reduce

Yes it should definitely require a capability. Still a risk that some admin-enabled method (like enabling an IPsec VPN) provides a path to it, but would reduce the potential for crafting weird inputs.