You turn it off thru iTunes when you sync the phone with a cable. And the service only bonds with your local IP while on WiFi if memory serves. In fact it might only attach when it is on your home network. When you hooked it to iTunes, it compared network settings on both devices to determine if WiFi sync was viable since they have to be on the same basic subnet. So technically it could truly secure things off if the design was well thought out. But I don't know for sure since I haven't done a full intrusion analysis to see if the port binding is on all WiFi networks or just the SSID at home.
