But security through obscurity is a valid part of a security methodology, and it’s a part that inherently a continuum rather than binary. For sure some aspects

But security through obscurity is a valid part of a security methodology, and it’s a part that inherently a continuum rather than binary. For sure some aspects of security are binary. But even with JWT (I agree with the main points of the article), a token with an expiry of 5 minutes but no revocation capabilities is still objectively preferable to no expiry at all. The binary aspect of security is primarily about whether you fall within your risk appetite or you don’t.