[piggity]

Having physical access to the network shouldn't (in a better world) result in such an utter compromise.

With the ability to plug in devices like the Pwn Plug; your network needs to be moderately resilient to attacks from inside.

[Lerc]

Agreed. In fact I would go as far to say that All systems should be deliberately connected to a network physically accessible from the outside world. That way you cannot hide behind the assumption that you have not inadvertently connected.

All security layers have to be based on what you are allowed to do. Cutting abilities in a non-privilege-restriction manner is just asking for people to figure out another way to get through.