If the SSH or WebUI access over the WAN ever gets enabled, inadvertently or sneakingly, via the phone app, you can set up access restrictions so only your LAN clients, or only a small subset of your most trusted LAN clients, have access to both SSH and WebUI. If you have a VPN server configured...