I don't get why you couldn't have a panic bit set the same way you maintain an in memory revocation leak... Also I don't get how this is any different than "wha

I don't get why you couldn't have a panic bit set the same way you maintain an in memory revocation leak... Also I don't get how this is any different than "what if a DB password" leaks? What if someone steals a device and copies the httpOnly cookies from the network developer inspector tab then forges the requests using Curl? I don't see how these problems are unique to JWTs and how they exist unmitigated with the use of in-memory revocation list.