@danny thanks Danny. So UpNp can be turned off and as long as port forwarding is set up, ARC works. I just confirmed it.
So unless Roon gets hacked and all user information is compromised, the encrypted connection and authentication Roon uses to connect and authenticate to client Roon core make this a pretty safe configuration, open port or not…my understanding is correct.