People are surprisingly chill about BMCs as attack surface, eg Intel management features get a lot more scrutiny.
That network should have no routing to the Internet and no production traffic, just BMC management.
When Intel ME shares the NIC used for the OS traffic - that is far harder to secure.
And no single computer with NICs on both the BMC network and one that can access the internet, hopefully.
All it takes is one single mistake.
And then there are people that just port-forward BMC ports to the internet as cheap remote KVM...
IMO it's wrong - It's terrible product design that servers have network ports that will cause catastrophic failures unless carefully only connected to a special expertly secured un-network for fragile things.