There usually is a reason to use more than one way to protect services. Combining credentials with access-lists ensures that one of those can fail without having to deal with an immediate emergency.
That doesn't mean you shouldn't act when one of them gets compromised, why would you have bothered with implementing more than one if you don't care about them?
Technical risks you may have to deal with include misconfiguration of access-lists and IP spoofing. That's why you don't rely just on an access-lists.
However, in my opinion the bigger problem is that the operation expects more than one security measure to be implemented. Someone else may notice a misconfigured access lists and think 'no worries, you still need credentials to use the service'.
Bottomline: if you implement more than one security measure, you need to be sure you can rely on every single one of them. Having more than one just reduces the direct impact of one of them being compromised.