In section 10.4 of 1.2 spec we have:

If the bean is a session bean, the observer method must be either a business method of the EJB or a static method of the bean class.

in 10.4.2 we also have:

If a non-static method of a session bean class has a parameter annotated @Observes, and the method is not a business method of the EJB, the container automatically detects the problem and treats it as a definition error.

This 2 assertions don't prevent an observer to be a business method of a remote client of an EJB. We should be more precise here and forbid this scenario.