Is ACF not able to tell if a function is being called remotely? It seems like the "argument matching" should only happen when it's actually a remote call, rather than every call for a method that can be accessed remotely.

+1

Are you saying only remote calls can be bad? Can you detail that farther?

As it stands, if a method has access="remote", all arguments that are ever passed must be declared in the method signature. Passing arguments that aren't declared throws an error, unless you use the jvm flag to disable this check, but using it opens your site up to the security issue(s) this change intends to fix. Unfortunately, that's true even if the method isn't being called remotely, passing undeclared arguments still throws an error.