I think some of this conversation is circling around the concept of 'allowable risk'...

We have a couple of VMs that are not mission critical, and they don't hold sensitive data. We just inject the secrets into the runtime. Access to those machines is restricted to a single IP, there's not much more protection in front of them.

A meaningful attack on one of those machines would require a LOT of effort, and almost nothing in return. Some systems don't NEED to have government level security, as a developer it's my job to provide the best solution for each scenario.

(IE, I wouldn't put 12 security cameras and an armed guard around a fruit stand, but I might around a jewelry store)