During a post-incident review, analysts find that an ACL had an implicit 'permit ip any any' instead of the expected 'deny ip any any'. What risk does this represent?

Remaining questions and full explanations are VIP-exclusive.