Settings, Phone remote is off by default, because it opens a port on the network. Turn it on and the control window shows a QR code, the address, and a four-digit PIN.
Scan the code on a phone on the same wifi, type the PIN once, and the phone has the playlist, blackout, manual or auto, and volume. Changes made on the Mac appear on the phone straight away.
The code carries only the address, so a photo of the screen is useless without the PIN. Wrong PINs lock the phone out after a few tries. Quitting the app signs every phone out.
The remote is given a filtered view on purpose: it never receives file paths or the PIN, and it names entries by an opaque id rather than by where they live.