And then you have firmwares which switch to 'in-band-management' for convenience, if they detect that.

If you don't disable that, and sometimes even then.

Making that shit available on your general uplink.