First off, witness nodes should not be exposed to the Internet.
There are only a few things like (RC) that are not consensus, which would require a hard fork.
Any attack vector on a witness node would be an attack vector on the chain and would require a hard/soft fork to address. I like my forks hard and consensual.
There have been a few changes I believe to address RC that some of us have upgraded to.