Just installed a brand new RB4011iGS+5HacQ2HnD-IN and went through the update, set admin password, set wifi password, and lock down procedure as instructed by Mikrotik. Disable bunch of stuff and only left ssh open and even that only from my home network cidr. All good, but doing an external port scan from an EC2 instance I noticed this:
\
nmap MY_EXTERNAL_IP
Starting Nmap 6.40 ( http://nmap.org ) at 2019-08-26 22:41 UTC
Nmap scan report for x.x.x.x (MY_EXTERNAL_IP)
Host is up (0.053s latency).
Not shown: 999 filtered ports
PORT STATE SERVICE
8089/tcp open unknown