The port range that we documented long ago enables Roon Remotes to remotely control Roon Cores. It was a minor change at the time when we put it into effect, and was designed to enable a fairly narrow set of use cases where media-related devices (cores and outputs) are segregated on a separate subnet, but control points are distributed around the house on a less restrictive network.
It is not, and was never meant to be, a generic remote access or firewall hole-punching solution for all forms of communication amongst all products in Roon’s ecosystem.
RAAT/Roon Bridge use several dynamically assigned ports on each side. This protocol is designed to work on a local network without artificial obstructions. Process or host-based firewall rules are the only viable solution if you plan to place firewalls inside of your LAN.