The vulnerability you are pointing to is in the net_api plugin, not in the EOS-BIOS software.

I'd rather see a transparent, consensus oriented, well orchestrated launch, than one obscured by a VPN system among a group of BP's.
I've never been an advocate of "Security by Obscurity" especially when BP's are suppose to act with complete transparency.

But I would wait to see EOS Canada's debunking of this issue before making further comments.