macOS Sierra (and possibly earlier) has some "hidden" screen sharing options:
If you're connecting to VNC using ssh tunneling, you can force macOS to listen only on localhost:
sudo defaults write /Library/Preferences/com.apple.RemoteManagement.plist VNCOnlyLocalConnections -bool yes
In newer versions of macOS, screen sharing will automatically re-lock the screen when you disconnect if it was locked when you first connected. To change this behavior, use:
sudo defaults write /Library/Preferences/com.apple.RemoteManagement RestoreMachineState -bool NO