Yeah I would argue if you want security you need to be using something like mutual tls, or a framework/system/etc., that provides the same.

That's from the perspective of the developer though, from an end user's perspective I guess you just hope your application is, or that it's something where it doesn't matter.