They could even have a 'reverse shell' type button that the client has to explicitly click to enable temporary remote access.