[DaSHacka]

How is it not improving the threat model to not have a service directly connected to the internet, but instead put behind a layer of protection?