Yep, I remember having ssh access to production servers from a non-work machine at a well known university.

We could also get external ips and connectivity without much supervision. Core security needs to be prioritized to avoid this from happening.