Yes, but this is caused by bad instructions on internet or people "experimenting" without studying the matter.
When you would have used quickset to setup PPPoE it would not be such a problem because there would be
an incoming firewall on the PPPoE.
But when you just configure the router as plain router, then remember PPPoE, watch a naive Youtube movie
on how to add a PPPoE interface, and do not adjust the firewall, yes then you are in trouble!
I have often proposed that the firewall is changed to do a default drop and accept only what is explicitly allowed
(like traffic from the LAN), but MikroTik won't do that. So it is your own responsibility to drop incoming traffic
from any new interface that you add.