Neo4j Bolt and HTTP connectors: does disabling authentication expose both protocols on all interfaces?

When authentication is disabled in Neo4j (dbms.security.auth_enabled=false), the server accepts connections without credentials. The Bolt connector (dbms.bolt.address) and the HTTP connector (dbms.http.address or dbms.connector.http.address) each have independent bind‑address settings. In many deployment formats the default is to bind both to 0.0.0.0, but administrators sometimes set only the Bolt address to limit exposure while leaving the HTTP connector at its default. This raises the question of whether disabling authentication alone is sufficient to prevent unintended public access to the HTTP endpoint, or whether the HTTP connector must also be explicitly restricted.

Consider the constraints of Community vs Enterprise editions, Docker default image port publishing, and the need to maintain compatibility with existing tooling that expects HTTP access on the standard port.

Does disabling authentication change the default bind address of the HTTP connector? If the Bolt connector is bound to a specific interface, does the HTTP connector inherit that setting or remain on all interfaces? What explicit configuration is required to ensure the HTTP connector is not publicly reachable when auth is off?