I'm having trouble following your line of reasoning, H1000. It seems on one hand you are arguing for multiple control devices to be able to operate an engine and on the other hand arguing that this very same thing would lead to 'havoc'.
I am arguing for an intermediate device that multiple remotes / apps connect to which in turns controls all of the trains on the track. It would be nice if all experienced operators in a club layout with a handheld or app could control any engine on the layout during a public or private event. If Bob sees a problem with Joe's engine, He can deal with it immediately with the interface in his hands without finding Joe and making him deal with it.
I don't see how allowing Bluetooth control of engines changes the safety/attention needs in any way over using a LionChief remote. either way only one operator has control of that locomotive.
3 different Legacy remotes can control any and all TMCC & Legacy engines on a layout without having to switch between remotes. The Bluetooth method locks a particular remote or app to particular engine(s) and all other remotes have no control over those engines
Perhaps the simplest solution for public displays where inexperienced and/or inattentive operators may have control of a LionChief engine would be to place a cut off switch in an easily accessible location, or even use a remote control one. This could be operated by whomever is monitoring the layout.
But your idea with the cut off switch is also good. If the layout goes dark, everyone will pay attention quickly. I'd choose this over broken trains and a big mess.
H1000
