"Legitimate" depends a lot on the environment. Should Spotify be pushing bits out to the world from your doctors PC? Should it be accepting inbound connections

"Legitimate" depends a lot on the environment. Should Spotify be pushing bits out to the world from your doctors PC? Should it be accepting inbound connections from other random people around the world? Now answer the same two questions after an exploit in the P2P library within Spotify is announced on HN.