Except that in many cases the BMC does not exposed to the internet, especially in situations where you get a dedicated server from somewhere and they want to give you low-level access to make changes to the server you are renting.

I know of at least 2 places where this is still the case (that or a remote IP KVM...).

The BMC should be on a trusted network, but most likely isn't.