Notice the object returned from the Naming.lookup method is cast to the actual interface class. The example makes a call to print the interest rate on the server, and it makes a request to amortize a schedule. If the amortize schedule is successful, the client gets a local copy of the schedule object. Then the client can call routines in the schedule object, modify the object, etc. This is the client's private copy of the object, and the server has no knowledge of any changes to this object made by the client.
Local objects are by copy, and remote objects are by reference.
The server has very simple code that is similar to the client. The server has the same requirements as the client has regarding the security manager. This is the actual remote object the server exports. When your client references the server, it will get the original reference to the object and not the latest. Also, when the client tries to reference the remote object, the server will throw an exception because the object is no longer valid.