Is it against Sitecore's best security practices to allow the gateway to Sitecore's management server to the public internet? e.g www.test.com/sitecore
Simply put, it's not best practices to expose the Sitecore login screen and backend to the public internet. Sometimes it's unavoidable. In those case, the thing to remember is that the CM server is just another website.
Hardening access to the file system and ensuring that your login screen is properly secured should be considered.
In most cases, the Best Practice is that the CM server is hidden behind the DMZ and only the Content Delivery server is exposed to the internet with the
sitecore folder disabled by authentication.