Yeah I really don't get the alarmism in the article, or in the white paper. Is there any legitimate reason to have UPNP exposed to the internet? If its exposed

Yeah I really don't get the alarmism in the article, or in the white paper. Is there any legitimate reason to have UPNP exposed to the internet? If its exposed on a public network, why bother with a buffer overflow when the protocol itself is designed to open whatever ports you want.