Even remote control, or, in general, input interception/injection. That's done via accessibility APIs I believe, and these do need to be enabled once per app in

Even remote control, or, in general, input interception/injection. That's done via accessibility APIs I believe, and these do need to be enabled once per app in the system preferences, and this does require root password or touch id, but a well-behaved app would not bypass that. A well-behaved app would guide you through granting it this permission in a supported way.