In its factory default state the equipment exposes only those network interfaces, and those services reachable over network interfaces and affecting security or financial assets, that are needed to set up the equipment or to run its basic functions.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.