block the port used by magic packet at the router.
That seems reasonable. However I can't think of a single Network Admin ever leaving a port like that open on the firewall intentionally. I know if I have to login into my network from outside to turn a computer on, I connect to the internal network using a vpn then issue the WoL packet to the computer in question.
I suppose the security issue arises when a haxor pwns a box on the internal network and is able to wake up other computers. But then again if a haxor pwns a box on the internal network we have bigger issues to worry about.