If by remote you mean "from WAN", then it's not enabled by default.
Wifi login cannot be disabled.
One way to better control management is to switch from HTTP to HTTPS, use a different port than the default 8443, and possibly enable the function to only allow management from specific IPs (all configurable on the same Administration -> System config page).
Can't speak to the factory firmware or Merlin's but TomatoUSB from Shibby ( 1.28.0000 MIPSR2-121 K26 USB AIO-64K). has a page in the web interface dedicated to Administrative Access and wireless access can be turned off as well as remote administrative access. I have not tested it, just trust it works.