Securing an ESX service console is important because:
A.
VMs depend on the patch level of the service console
B.
Service Console actions can affect all VMs on an ESX host
C.
Service Console permissions are applied to users when logging in to a host via vCenter
D.
VMs run in the service console
Explanation:
With VMware ESX being loaded on top of the server hardware, there are a few points of immediate concern:
1. the VMKernel & its virtualization layer
2. the VMware ESX Service console (based on Red Hat Linux Enterprise) These two pieces are two very distinct parts of VMware ESX. VMware has periodically released patches for both of these different components although you probably just thought of them as "ESX patches".
Concerning #1, the VMKernel and its virtualization layer is extremely secure. The Guest machines have hardware isolation in place and it seems impossible that a guest VM could somehow compromise the security of the host virtualization layer. As for #2, with the services console being based on Linux, it will be affected by most of the Red Hat Linux vulnerabilities. Because the service console is a Linux OS with a direct link to the VMKernel, I will focus on securing the service console