True, those are also a foot gun--especially for AWS services where you'd want to, instead, switch to VPC Endpoints above a trivial amount of traffic (I think the endpoint interface is like $2/mon so has a small cost)