I agree, and there was more security. However access to the app implies the ability to DoS the remote with too many login attempts... Restricting access to the app was just one layer in the security scheme making it a little harder for someone who wanted to mess with the system.