Behavior of OPA/TTA telnet server

I'm surprised (actually amazed) by the apparent default behavior of the FreeAXP telnet server for the console and serial port - they accept multiple concurrent connections from multiple ip addresses. This is completely counter-intuitive and seems a huge security hole ... have I missed something?

It is no different than any other application that is accessed via an IP port. It's a hole it you don't manager IP port access effectively. It is a feature if you want access to one of the virtual serial ports from a remote location.

I can see how it might be a useful feature to enable, but I can't see how this can be viewed as safe, as a default configuration.

Perhaps the following options should be available:
Allow concurrent connections - yes/no (default no)
Allow connections other than localhost - yes/no (default no)

I can't think of any common network application that would drop you into an existing session without any authentication, certainly not a console port.