Sort:  

First off, witness nodes should not be exposed to the Internet.
There are only a few things like (RC) that are not consensus, which would require a hard fork.

Any attack vector on a witness node would be an attack vector on the chain and would require a hard/soft fork to address. I like my forks hard and consensual.

There have been a few changes I believe to address RC that some of us have upgraded to.