This anti-pattern is present when non-public assets reachable from the internet can be accessed with single-factor authentication; to attain the level it must be absent, with multifactor authentication required for such access.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.