Based on our analysis, about 43% of cloud environments are vulnerable to these vulnerabilities, with our research uncovering over 6,500 clusters, including Fortune 500 companies, that publicly expose vulnerable Kubernetes ingress controllers’ admission controllers to the public internet—putting them at immediate critical risk.

I don't understand that. Under what circumstances are those admission controllers exposed to the public internet? The k8s API of my EKS is definitely exposed to the public internet, but my understanding is that it will say "no" to whatever unauthenticated request it receives, isn't it?