No kidding. No doubt that the hardware probably has built-in VPN functionality too so..why would you expose a management interface to the internet. Its either lazy stupid or both.