well .. yeah
My HA links are all p2p when possible, and on a isolated vlan, never routable. Y mgmt interfaces are all isolated and require admin group VPN... But yeah, global protect is on dataplane, and by its nature, accessible. Being an unauth attack, That's a 10 in my book.