Security controls are applied to external interfaces (Table B4, 18.1: USB or other ports used for code injection, 18.2: infected media, 18.3: diagnostic access such as OBD dongles used to manipulate parameters).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.