I've been wondering about this. From what I read, people only open 9735 to run a "successful" node.
To me it makes sense not to open bitcoins port, but I could also imagine that some scanners out there scan for bitcoin nodes and upon success check the same IP for an additional lightning node.
