It was limited to local access for people using the default settings, though, since ARD is something you have to explicitly enable in the system preference. No

It was limited to local access for people using the default settings, though, since ARD is something you have to explicitly enable in the system preference. Not that this isn't a bad thing, but it's vastly better than a remote execution exploit which is default-enabled.