No, that's their business model.

No, but you can quite easily make it unusable from a certain IP address apparently.

I'm willing to bet that if someone can social engineer their support staff into opening a console from their corp address, yes (in a way lol)