Even with EC2 classic, every machine is locked down from every other. The typical way around this is to modify the default security group, which is limited to

Even with EC2 classic, every machine is locked down from every other. The typical way around this is to modify the default security group, which is limited to your account and your instances. It's a different approach than VPC, but everyone had effectively private networks with EC2 Classic, unless they really went out of their way to open up everything to everyone. Granted we're probably now distinguishing between being able to see unencrypted traffic and being able to access ports on a machine. They're both bad, but I'd argue having your DB port exposed to the world is probably worse.