Ran a fleet of servers with terrible BMCs. We kept those on a well-sealed-off private network.

Woe betide you if you run into one of the BMC implementations that shares a host network interface; no separate cable! These things are terrible from a security standpoint.