Just got the popup about trying the Android app, which acts as a remote
for the client, and I tried it and it worked... with *no access control*
or even a popup...

lsof confirms that kphotoalbum is just listening on a port:

kphotoalb 29586 eichin   25u  IPv4            1687321      0t0      UDP *:23455

https://www.youtube.com/watch?v=TxtD7BG61Ro at +9m10s describes how to
turn it off, and there's a tiny button on the bottom of the screen to
turn it off.

I couldn't find a specific reference in the policy guide asserting that
things like this should be closed-by-default, but it just seems
obvious...

main.cpp has
    options.add("nolisten-network", ki18n( "Don't start listening for android devices on startup." ));

which is backwards - and looking a little bit more (and experimenting)
confirms that it doesn't *stay* off, it doesn't save the user's choice
to the config file.

Probably should be a higher severity than "normal" but I haven't
explored quite far enough to confirm that there really is no way to
cleanly leave it off.  It's a very nice feature, it's just not in any
way safe to have turned on by default...

Got email from the upstream author who pointed out (and I just
confirmed) that once you've started, hit *Settings, *Configure
KPhotoAlbum, under the "General" Tab, "Miscellaneous" section, you can
uncheck *Listen for Android devices on startup.

I believe that for Debian this should certainly default to unchecked.

Since this gets written out to ~/.kde/share/config/kphotoalbumrc under
[General] as listenForAndroidDevicesOnStartup=false, it might be
possible for the Debian-specific patch to install something in the
existing global config in /usr/share/kde4/config/kphotoalbumrc though
that uses different stanzas and I don't know what the exact change there
should be (if I did, I'd have supplied a diff :-)