This is indeed odd. On my home network, I have a firewall at the edge, a firewall on each machine, and every service requires authentication (cryptographic where possible; username+password over SSL otherwise). It took me about a day to set up, and I'm not even a security person.

It's unacceptable that people whose jobs are to secure computer networks do a worse job than I do for the little computer under my TV.

(Yup, all of my machines at home have a public IP address. Convenient!)