Why should access to etcd be tightly restricted?

1. It automatically rejects every unauthenticated file-system read
2. It contains sensitive cluster state, including Secrets
3. It only stores harmless container log rotation settings
4. It is the public image distribution endpoint