This is only true after the Mongo people were lambasted on the web for having such a terribly insecure out of the box product. Which was fairly recently. For years the product would bind to all IP addresses.  Which is insane for a default install.<p>Feb 2015:<p>Discovered 40,000 vulnerable MongoDB databases on the Internet<p><a href="http:&#x2F;&#x2F;securityaffairs.co&#x2F;wordpress&#x2F;33487&#x2F;hacking&#x2F;40000-vulnerable-mongodbonline.html" rel="nofollow">http:&#x2F;&#x2F;securityaffairs.co&#x2F;wordpress&#x2F;33487&#x2F;hacking&#x2F;40000-vuln...</a><p>The changes were made after this, so we&#x27;re only talking a few months now.