Because the metadata server should never be reachable from the outside. It should only be available internally (which is on the admin network).

How is it broken?