They are firewalled and can only communicated with other devices on the LAN. We use the other systems on the LAN to jump to the KVMs. No simple infrastructure attack is possible.