How does the nature of remote access address the legal concern (presumably) about there being remote access in general?

That isn't my presumption about nature of the concern. In OP's other comment they specify that the client is specifically worried about the open port.