The risk is limited to manually exposed APIs, and version 2.4.4 closes the standard public path.