It does not have to magically open the server to open an attack vector against the site by other means, e.g. MITM on an open WiFi access point. Other comments

It does not have to magically open the server to open an attack vector against the site by other means, e.g. MITM on an open WiFi access point. Other comments in this thread discuss this in more depth so I’m not elaborating here.