There are numerous ways to ensure this isn't accessible via an external source. Indeed, even if it did come with username/password authentication, or 2-factor authentication, it still would be an exploit waiting to happen if exposed.

You shouldn't be putting these things out on the open web in the first place.

So "No auth" isn't a bad thing, as there are better tools to ensure authorization is done before ever getting access.

Edit: should to shouldn't

This could be secured with a private network and a firewall. It would be nice if the readme mentioned the security vulnerability this exposes, and maybe a suggestion on how to secure the telnet port. I am sure that someone is going to install this without thinking to secure the telnet port.

Spoiler alert: Your "private" network isn't.

This seems like something that shouldn't be listening on 0.0.0.0, so no auth wouldn't be absolutely terrible.

But everyone knows that someone will use this on a production server with unsafe settings, especially if it doesn't restrict access by default.

This could be fairly secure with an IP whitelist on the port using something like IPTABLES, right?

Of course, you don't want it on your mission-critical production machine, but then that's not really what it's for.