This link explains exactly what I also thought.
I thought the content goes through the portal and don't needs direct access....this is now a very bad surprise 
Do you know, if this is still valid, so that also all backend-systems needs to be accessable?
What is the sense of the portal than, I thought this is one function of it...
Accessing Backend Content through the Enterprise Portal from the Internet