I suspect this will get fixed as an added-extra with fixing people being able to join without permission

I'm guessing they currently open a port to listen for a join, then on connection immediately work out which player character is not being controlled, and hand the reins to the remote client. In adding permission requirements, they'll then be able to turn off joining under certain conditions.
Of course, ideally you might even allow your friend to take over character design for one of the characters entirely
