The eosio::net_api_plugin was made optional for this very reason. No producer or public endpoint should be running with this plugin and it is a simple config file change.
I feel like the intro to this post is overly alarmist way to support an otherwise worthwhile effort at securing block producing nodes.
Sorry guys but eat some humble pie on all the judgments that some put on this group for trying to bring all this up prior to the launch. No one listened.
Now here we are 2-3 days later and BOOT BIOS didn't deliver. All that hype. All that political BS, pomp and circumstance, etc... and in the end, they feel flat on their face.
Funny the difference that just a few days makes. ;)
In the end, the very people you put in question ended up being the talent that will launch the chain.
Are you aware of the Ghostbusters project?