Seems like a good reason you should need to "pair" the RF remote to the device, similar to Bluetooth. Otherwise a bad actor in an apartment complex could get a "universal" RF remote and randomly try stuff until they can control your devices.

Why? It sounds like the system is working as unintended.

Honestly I could see arguments going both ways. Pairing prevents unauthorized access, but at the same time, pairing means you need to be able to pair without having a paired device on-hand.

For a passive read-only device (like most satellite/cable receivers 20 years ago), it was probably more important to allow customers to easily replace their lost remotes than it was to prevent pranksters (who could often be dissuaded by more physical means).