If you just don't plug in the BMC network port, you effectively have this. But people do plug in the BMC network port because it's extremely useful.

And then you have firmwares which switch to 'in-band-management' for convenience, if they detect that.

If you don't disable that, and sometimes even then.

Making that shit available on your general uplink.