MongoDB manual has some good recommendations on operations here: http://docs.mongodb.org/manual/administration/security/#oper...

It certainly helps limit the damage. However, unless it is chroot-ed, it will still pose a very serious risk. And even with chroot, the damage is not totally eliminated. The attacker can start leveraging local vulnerabilities.