Disclaimer
The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.
Liability Disclaimer
In no event shall Author be liable for any damages whatsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.
Posting
I too cannot see DR priority as a security risk, as the real risk would be allowing an "unknown" router join your network.
In theory, if we get on a low performance router, and set its priority to make it the DR, such that it's effectively becomes a DoS attack, we have deeper security concerns such as how did someone get on a router to change its priority and/or cause the current DR to drop to force a DR election. If someone has such unauthorized access, they can do much more than change DR priority.
In my experience, some security folk are the equivalent of script kiddies, they don't really understand the technology and what's really relevant or not from a security perspective. Often they just use some "checklist", which may be incorrect. Often if there's not a deep understanding of the technology, a false sense of security is created.
Just one example, years ago I had "security folk" tell me you cannot have the default administrator account with the name "administrator". I asked why, and the answer was, well that's an account that hackers would want to attack, so we don't want to make it obvious. I said okay, then I wrote a simple program, as a non-admin user, and asked the OS for all the account names with administrator access (which it provided). I told them, personally, I would be more interested in how secure the passwords are on all the administrator accounts, how many failed logon attempts are allowed, unusual account usage activity, etc., rather than the name of one of many administrator accounts, but sure, let's rename it, we'll then be so much more secure.
Same place, "security folk" insisted system require passwords to use both upper and lower case. I said sure, good long term practices, but you do realize older clients don't internally support lowercase passwords, so when they logon, OS translates any lowercase to upper case. I.e., so since a logon program can request old logon handling, you've not really improved the password space.
However, the important thing was, we complied with both the security checklist items.
