This is correct. But the port wont reply to anything but a valid client, so it should not be too apparent to a would-be attacker that you have a port open at all.

And it works with google cast out of the box!