@brian mentioned some of the issues arising from port forwarding (one way in which a distant computer can pretend to be on the LAN) in this post.
The devs have indicated that distant access is on the roadmap and the proposed solution is unlikely to require a VPN.
Generally speaking I am in favour of user configurability but I think it is fair to say that Roon design principles put a higher value on a single robust solution rather than a wider choice of variable quality alternatives.
Accordingly my guess is that the distant access solution will be more of a railroad track than the open garden you are describing. I’m not privy to any special information here, that’s just a guess (and a hope !).
Sometimes reading how various networks misbehave reminds me of looking at my girlfriend’s cat perched atop some structure and yowling to be let down - how the hell did it get into that position ?
Edit: I’ve referred to distant access rather than the more usual remote access in order to avoid confusion with the Roon Remote nomenclature.