BMCs by themselves don't necessarily have network access. The AST2500 and AST2600 present themselves to hosts as a PCIe video card and USB keyboard, mouse, and storage, but they don't interact with the host's network interfaces. If you aren't using your LOM ports, they have no network access at all.
If you are using your LOM ports, then just don't let your LOMs talk out to the Internet. Note that this will break the ability many modern LOMs have to report hardware faults to the vendor for automatic RMA (e.g, when one of my open servers' drives fails, a new drive just shows up in the mail without needing me to open a ticket manually).
One major note, though: that Bloomberg story is complete nonsense. Everybody cited as affected has issued explicit denials (not just "We don't know what Bloomberg is talking about", but actively saying "Bloomberg is wrong"). A huge amount of independent research afterwards has turned up nothing.