From my understanding, the impetus was that F5 submitted a CVE for a vulnerability, for an optional, “beta” feature that can be enabled. Dounin did not think a CVE should be submitted, since he did not considered it to be “production” feature.
That said, the vulnerability is in shipping code, regardless of whether it is optional or not, so per industry coding practices, it should either be patched or removed entirely in order to resolve the issue.
It itself is not FOSS, but Network Chuck just had a decent video on setting up ThinLinc for his editing team. I believe it is free for ten or fewer users. There is an admin function that allows you to observe what another user is doing (session shadowing).
https://m.youtube.com/watch?v=qdo5lMR1lX4
In general, for native FOSS, I’m pretty sure you can specify the screen port in VNC, and connect multiple users to the same port, but you’d have to double check the configuration file. Can likely also be done with XRDP.