SameSite works if I use the same domain for my API as for my CDN, and don't integrate third party APIs. Doesn't seem to actually solve the real security proble

SameSite works if I use the same domain for my API as for my CDN, and don't integrate third party APIs. Doesn't seem to actually solve the real security problems with the web, which is that people don't know how it works, and there is no security model that works that matches physical security that people do understand.