Hello Paul,
Thank you for your message.
This is the correct behavior. The purpose of shared secret is to provide the means to verify the identity of a remote Host, not to serve as another password or authentication factor. The program logic here is as follows: If there is a shared secret on the Viewer side (in connection properties) then the program performs the identity check. If it's empty , then the check isn't performed because the program assumes that admin doesn't want to perform identity check and it should let admin connect in.
That said in version 6.9 (as of Sep 25, 2018 in beta
available for download) this system was totally replaced by a more modern certificate-based check. Now the process is automatic and doesn't require user intervention except only when there is certificate mismatch and the user is warned about it and asked for further actions. Here is a related
documentation page for your reference.
By the way, in version 6.9 we also implemented two-factor authentication so if you want to add more security this is just what you need.
Hope that helps.