Hiding ADO connection string and recordset

Question

I'm trying to hide as much as possible within the ADO sections of code in my Excel-vba routines by making scopes as strict as possible.

Module 1:

Sub control()

Const strConn As String = _
    "PROVIDER=SQLOLEDB.1;" & _
    "PASS******=xxxxxxxxxxxxxxxxx;" & _
    "PERSIST SECURITY INFO=True;" & _
    "USER ID=xxxxxxxxxxxxxxxxx;" & _
    "INITIAL CATALOG=xxxxxxxxxxxxxxxxx;" & _
    "DATA SOURCE=xxxxxxxxxxxxxxxxx;" & _
    "USE PROCEDURE FOR PREPARE=1;" & _
    "AUTO TRANSLATE=True;" & _
    "CONNECT TIMEOUT=0;" & _
    "COMMAND TIMEMOUT=0" & _
    "PACKET SIZE=4096;" & _
    "USE ENCRYPTION FOR DATA=False;" & _
    "TAG WITH COLUMN COLLATION WHEN POSSIBLE=False"

Dim c As ADODB.Connection
Dim r As ADODB.Recordset

Set c = New ADODB.Connection
c.ConnectionTimeout = 0
c.Open strConn

Set r = New ADODB.Recordset
r.ActiveConnection = c

Call someADOproc(r)

End Sub

Module 2:

Sub someADOproc(ByRef ar As Object)

ar.Open _
    "SELECT top 1 Operator " & _
    "FROM   xxxxxxxxx.dbo.xxxxxxxxxxxx "

MsgBox ar.Fields(0).Value

End Sub

The strict scope of the variables in the routine control makes me surprised that ByRef actually works and that the variable is available within the routine someADOproc that is located in a different module? I was expecting this to fail.

ByVal also works - this is as expected as it is passing in a copy of the recordset r ?

What is missing in my understanding of these concepts?

Should I use ByVal or ByRef?