This is not a a couple of someone not being smart. If the remote user is nervous about a random stranger accessing their PC, remind them increased success and sustained they will guess the ID and Password codes which allow each get to.
Often we do not need the rules at all.