I'm sure it's a bit dangerous, but when you run it as done in the article, behind an Apache Reverse Proxy with Apache authentication, you're relying hugely on A

I'm sure it's a bit dangerous, but when you run it as done in the article, behind an Apache Reverse Proxy with Apache authentication, you're relying hugely on Apache for the sync security, and that has been well designed to protect against a very large attack surface. Another advantage is that you're just different. So if someone (or some State) attacks a commonly-used service, this will be protected simply by being different.