It’s a whitelist. Only phone numbers you explicitly allow can send commands. Alternatively, you can choose to enable a pin that must be given in order to execute commands.