Nova instances on Neutron networks: can the default security group be trusted to block accidental public access?

Context

We run Nova compute instances attached to Neutron networks, with floating IPs allocated on demand. The goal is a defensible baseline where no instance becomes reachable from the public internet unless an operator deliberately opens a specific port.

Uncertainty

Neutron applies security groups as stateful, allow-only filters on each VM port, and the auto-created 'default' group permits all egress plus ingress only from peers in the same group. In practice, though, exposure seems to creep in through added 0.0.0.0/0 ingress rules in templates, remote-group rules that change effective access as membership shifts, and ports where port_security_enabled has been set to false (which also drops anti-spoofing). Because groups are per-project, there appears to be no built-in way to answer 'is anything in this cloud publicly reachable?' across all projects at once.

We also understand floating IPs do not bypass security-group filtering, so the group rules are the real enforcement point. Assume a recent OpenStack release with the standard Neutron firewall driver; exact defaults may vary by operator.

Questions

1. Is relying on the auto-created default security group a safe baseline, or should we enforce an explicit deny-by-default group per project?
2. What is the practical way to audit for 0.0.0.0/0 ingress rules and disabled port security across many projects?
3. Should broad allowed-address-pairs be treated as equivalent to disabling anti-spoofing during such an audit?