Redis should not be assumed safe just because it sits inside a VPC or private subnet. I enable authentication or ACLs, bind deliberately, and keep the service off public networks entirely. Fast infrastructure becomes dangerous infrastructure when teams treat defaults as security boundaries.