AFAIK Yggdrasil does not listen by default and you can make an entirely private Yggdrasil network.

But given both are in Go I would not expect RCEs to be common in either.