I think the commenter above is making the point that this should be defence-in-depth.

Yes, of course use good encryption and auth{n,z}, but _also_ layer on restrictions at the network layer to stop general traffic from even getting there.