Hi Alexia,
First, thank you for your prompt and comprehensive reply! With the holidays, I only saw your reply today.
Points taken re security issues. I've been wanting to learn how to set up VPN tunneling myself, but so much to do

. I'm sure there is a 'how to' on this site and will follow-up.
Re his having open remote VNC access, I was counting on limited exposure, a very strong password, and changing of the password after each connect, since I believe VNC passwords are sent unencrypted. Had he a router, I would have used source IP filtering, given my ignorance of VPN setup. Wouldn't that be pretty secure - spoofing can't defeat it without FULL control of an intermediate node?
I've been unable to reach my friend, but a call to Comcast indicates there may be a problem on their end (traceroute searches forever for his system - which is sleeping - I thought the modem would do a link-level ack, and terminate the trace, but the tech didn't know). I will confirm once I've got my friend on the line. They also filter for ports that are often exploited, but he didn't think 5900 was one of them (135 is, for example.
In the meantime, perhaps I did leap to some erroneous conclusion(s) (he does have an Airport Express). His configuration:
1. A new iMac with a direct wired connection to a Comcast modem. I inferred there was no firewall fuctionality, because his TCP/IP panel reports only the public IP address. Comcast confirms their modems don't provide internal routers.
2. He hired an independent mac consultant to set up his config - I agree there is no substitute for a hardware firewall, even if you're on a more secure and less targeted platform such as the Mac (OS X).
3. The consultant later added a remote Airport Express solely for use with iTunes - using WEP encryption, when WPA was available! While visiting, I had made a quick attempt to gateway from my laptop through his iMac's wireless network to the internet, but without success. I was careful to restore settings to initial values. ==> Please tell me if the mere existence of this wireless network might be causing problems.
You said Macs do ack pings 'by default' - how do you control this in Mac OS X? I doubt the consultant would have disabled acks, and doubt he has any add-on firewall software, again suggesting a Comcast problem. Each time I've worked with him, I've had him read me his (public) IP address, so IP re-assignment hasn't been the problem.
BTW, he does NOT have any local peers, including an XP system, to test with.
Many thanks to you, and to your sharing your expertise!
Hope you are having a great July 4 weekend,
Paul H.