I have not updated my LMS yet but I thought I'd try connecting via a VPN to see what happens.
I installed OpenVPN on a Pi (not the one running LMS) and used port forwarding on intermediate routers to get the traffic from an iOS device using iPeng through the VPN server to the LMS server ... and it worked.
LMS logs show that it saw the IP address of the connection as being the VPN server.
So I think that when I update LMS this will still work without me needing to set a password on LMS.

I know that my LMS is not reachable from outside except through this VPN so this is good for me.